RHSA-2018:2948 — Red Hat Security Advisory: kernel-alt security, bug fix, and enhancement update

Fixed packages 20

Release	Package	Fixed in
Red Hat · RHEL 7 enterprise_linux:7::server	kernel	0:4.14.0-115.el7a
Red Hat · RHEL 7 enterprise_linux:7::server	kernel-abi-whitelists	0:4.14.0-115.el7a
Red Hat · RHEL 7 enterprise_linux:7::server	kernel-alt	0:4.14.0-115.el7a
Red Hat · RHEL 7 enterprise_linux:7::server	kernel-bootwrapper	0:4.14.0-115.el7a
Red Hat · RHEL 7 enterprise_linux:7::server	kernel-debug	0:4.14.0-115.el7a
Red Hat · RHEL 7 enterprise_linux:7::server	kernel-debug-debuginfo	0:4.14.0-115.el7a
Red Hat · RHEL 7 enterprise_linux:7::server	kernel-debug-devel	0:4.14.0-115.el7a
Red Hat · RHEL 7 enterprise_linux:7::server	kernel-debuginfo	0:4.14.0-115.el7a
Red Hat · RHEL 7 enterprise_linux:7::server	kernel-debuginfo-common-ppc64le	0:4.14.0-115.el7a
Red Hat · RHEL 7 enterprise_linux:7::server	kernel-devel	0:4.14.0-115.el7a
Red Hat · RHEL 7 enterprise_linux:7::server	kernel-doc	0:4.14.0-115.el7a
Red Hat · RHEL 7 enterprise_linux:7::server	kernel-headers	0:4.14.0-115.el7a
Red Hat · RHEL 7 enterprise_linux:7::server	kernel-tools	0:4.14.0-115.el7a
Red Hat · RHEL 7 enterprise_linux:7::server	kernel-tools-debuginfo	0:4.14.0-115.el7a
Red Hat · RHEL 7 enterprise_linux:7::server	kernel-tools-libs	0:4.14.0-115.el7a
Red Hat · RHEL 7 enterprise_linux:7::server	kernel-tools-libs-devel	0:4.14.0-115.el7a
Red Hat · RHEL 7 enterprise_linux:7::server	perf	0:4.14.0-115.el7a
Red Hat · RHEL 7 enterprise_linux:7::server	perf-debuginfo	0:4.14.0-115.el7a
Red Hat · RHEL 7 enterprise_linux:7::server	python-perf	0:4.14.0-115.el7a
Red Hat · RHEL 7 enterprise_linux:7::server	python-perf-debuginfo	0:4.14.0-115.el7a

Vulnerabilities 42

High 7.3

CVE-2018-10877

Linux kernel ext4 filesystem is vulnerable to an out-of-bound access in the ext4_ext_drop_refs() function when operatin…

[UNKNOWN] kernel: linux-raspi2 linux-hwe Debian Ubuntu

Jul 18, 2018
Medium 6.5

CVE-2018-14641

A security flaw was found in the ip_frag_reasm() function in net/ipv4/ip_fragment.c in the Linux kernel from 4.19-rc1 t…

The Linux Foundation Kernel

Sep 18, 2018
Medium 6.2

CVE-2018-14619

A flaw was found in the crypto subsystem of the Linux kernel before version kernel-4.15-rc4. The "null skcipher" was be…

[UNKNOWN] kernel: linux Debian

Aug 30, 2018
Medium 5.5

CVE-2018-10880

Linux kernel is vulnerable to a stack-out-of-bounds write in the ext4 filesystem code when mounting and writing to a cr…

[UNKNOWN] kernel: linux-raspi2 linux-hwe Debian Ubuntu

Jul 25, 2018
Medium 5.5

CVE-2018-3639 Public exploit EPSS 60%

Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addre…

Intel Multiple linux-raspi2 linux-hwe Debian Ubuntu Alpine

May 22, 2018
Medium 4.8

CVE-2018-10878

A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bounds write and a denial of s…

[UNKNOWN] kernel: linux-raspi2 linux-hwe Debian Ubuntu

Jul 26, 2018
Medium 4.8

CVE-2018-10882

A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound write in in fs/jbd2/tran…

[UNKNOWN] kernel: linux-raspi2 linux-hwe Debian Ubuntu

Jul 27, 2018
Medium 4.8

CVE-2018-10883

A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bounds write in jbd2_journal_d…

[UNKNOWN] kernel: linux-raspi2 linux-hwe Debian Ubuntu

Jul 30, 2018
Medium 4.2

CVE-2018-10879

A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause a use-after-free in ext4_xattr_set_entry…

[UNKNOWN] kernel: linux-raspi2 linux-hwe Debian Ubuntu

Jul 26, 2018
Medium 4.2

CVE-2018-10881

A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound access in ext4_get_group…

[UNKNOWN] kernel: linux-raspi2 linux-hwe Debian Ubuntu

Jul 26, 2018
Low 2.8

CVE-2018-1120 Public exploit

A flaw was found affecting the Linux kernel before version 4.17. By mmap()ing a FUSE-backed file onto a process's memor…

[UNKNOWN] kernel: linux-raspi2 linux-hwe Debian Ubuntu

Jun 20, 2018
Low 2.3

CVE-2018-1118

Linux kernel vhost since version 4.8 does not properly initialize memory in messages passed between virtual guests and …

kernel vhost linux-raspi2 linux-hwe Debian Ubuntu

May 10, 2018
Unscored —

CVE-2017-13166

An elevation of privilege vulnerability in the kernel v4l2 video driver. Product: Android. Versions: Android kernel. An…

Google Android linux-raspi2 linux-hwe Android Debian Ubuntu

Dec 6, 2017
Unscored —

CVE-2017-16648

The dvb_frontend_free function in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel through 4.13.11 allows loca…

Nov 7, 2017
Unscored —

CVE-2017-17805

The Salsa20 encryption algorithm in the Linux kernel before 4.14.8 does not correctly handle zero-length inputs, allowi…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Dec 20, 2017
Unscored —

CVE-2017-17806

The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8 does not validate that the underlying cryptog…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Dec 20, 2017
Unscored —

CVE-2017-18075

crypto/pcrypt.c in the Linux kernel before 4.14.13 mishandles freeing instances, allowing a local user able to access t…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Jan 24, 2018
Unscored —

CVE-2017-18208

The madvise_willneed function in mm/madvise.c in the Linux kernel before 4.14.4 allows local users to cause a denial of…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Mar 1, 2018
Unscored —

CVE-2017-18344 Public exploit

The timer_create syscall implementation in kernel/time/posix-timers.c in the Linux kernel before 4.14.8 doesn't properl…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Jul 26, 2018
Unscored —

CVE-2018-1000026

Linux Linux kernel version at least v4.8 onwards, probably well before contains a Insufficient input validation vulnera…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Feb 9, 2018
Unscored —

CVE-2018-1000200

The Linux Kernel versions 4.14, 4.15, and 4.16 has a null pointer dereference which can result in an out of memory (OOM…

linux-raspi2 linux-hwe linux-azure linux-gcp Debian Ubuntu

Jun 5, 2018
Unscored —

CVE-2018-1000204

Linux Kernel version 3.18 to 4.16 incorrectly handles an SG_IO ioctl on /dev/sg0 with dxfer_direction=SG_DXFER_FROM_DEV…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Jun 26, 2018
Unscored —

CVE-2018-10322

The xfs_dinode_verify function in fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel through 4.16.3 allows local users t…

linux-azure linux-riscv linux-gcp linux Debian Ubuntu

Apr 24, 2018
Unscored —

CVE-2018-1065

The netfilter subsystem in the Linux kernel through 4.15.7 mishandles the case of a rule blob that contains a jump but …

linux-raspi2 linux-hwe linux-azure linux-riscv Linux Debian Ubuntu

Mar 2, 2018
Unscored —

CVE-2018-1068

A flaw was found in the Linux 4.x kernel's implementation of 32-bit syscall interface for bridging. This allowed a priv…

Linux Kernel Organization Linux Kernel linux-raspi2 linux-hwe Linux Debian Ubuntu

Mar 16, 2018
Unscored —

CVE-2018-1092

The ext4_iget function in fs/ext4/inode.c in the Linux kernel through 4.15.15 mishandles the case of a root directory w…

linux-raspi2 linux-hwe linux-azure linux-riscv Linux Debian Ubuntu

Apr 2, 2018
Unscored —

CVE-2018-1094

The ext4_fill_super function in fs/ext4/super.c in the Linux kernel through 4.15.15 does not always initialize the crc3…

linux-raspi2 linux-hwe linux-azure linux-gcp Linux Debian Ubuntu

Apr 2, 2018
Unscored —

CVE-2018-10940

The cdrom_ioctl_media_changed function in drivers/cdrom/cdrom.c in the Linux kernel before 4.16.6 allows local attacker…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

May 9, 2018
Unscored —

CVE-2018-1095

The ext4_xattr_check_entries function in fs/ext4/xattr.c in the Linux kernel through 4.15.15 does not properly validate…

linux-raspi2 linux-hwe linux-azure linux-gcp Linux Debian Ubuntu

Apr 2, 2018
Unscored —

CVE-2018-11506

The sr_do_ioctl function in drivers/scsi/sr_ioctl.c in the Linux kernel through 4.16.12 allows local users to cause a d…

linux-raspi2 linux-hwe linux-azure linux-gcp Debian Ubuntu

May 28, 2018
Unscored —

CVE-2018-12232

In net/socket.c in the Linux kernel through 4.17.1, there is a race condition between fchownat and close in cases where…

linux-raspi2 linux-hwe linux-azure linux-gcp Debian Ubuntu

Jun 12, 2018
Unscored —

CVE-2018-13405 Public exploit

The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Jul 6, 2018
Unscored —

CVE-2018-5344

In the Linux kernel through 4.14.13, drivers/block/loop.c mishandles lo_release serialization, which allows attackers t…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Jan 12, 2018
Unscored —

CVE-2018-5390 EPSS 72%

Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service

Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service.

Linux linux_kernel linux-raspi2 linux-hwe Linux Debian Ubuntu

Aug 6, 2018
Unscored —

CVE-2018-5391 Public exploit EPSS 32%

The Linux kernel, versions 3.9+, IP implementation is vulnerable to denial of service conditions with low rates of specially modified packets

The Linux kernel, versions 3.9+, is vulnerable to a denial of service attack with low rates of specially modified packets targeting IP fragment re-assembly. An attacker may cause a denial of service condition by sending specially crafted IP fragments. Various…

Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu

Sep 6, 2018
Unscored —

CVE-2018-5750

The acpi_smbus_hc_add function in drivers/acpi/sbshc.c in the Linux kernel through 4.14.15 allows local users to obtain…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Jan 26, 2018
Unscored —

CVE-2018-5803 Public exploit

In the Linux Kernel before version 4.15.8, 4.14.25, 4.9.87, 4.4.121, 4.1.51, and 3.2.102, an error in the "_sctp_make_c…

Linux Foundation Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu

Jun 12, 2018
Unscored —

CVE-2018-5848

In the function wmi_set_ie(), the length validation code does not handle unsigned integer overflow properly. As a resul…

Qualcomm Android for MSM, Firefox OS for MSM, QRD Android linux-raspi2 linux-hwe Android Browsers Debian Ubuntu

Jun 12, 2018
Unscored —

CVE-2018-7566

The Linux kernel 4.15 has a Buffer Overflow via an SNDRV_SEQ_IOCTL_SET_CLIENT_POOL ioctl write operation to /dev/snd/se…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Mar 30, 2018
Unscored —

CVE-2018-7757

Memory leak in the sas_smp_get_phy_events function in drivers/scsi/libsas/sas_expander.c in the Linux kernel through 4.…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Alpine

Mar 8, 2018
Unscored —

CVE-2018-8781

The udl_fb_mmap function in drivers/gpu/drm/udl/udl_fb.c at the Linux kernel version 3.4 and up to and including 4.15 h…

Check Point Software Technologies Linux Kernel linux-raspi2 linux-hwe Linux Network devices Debian Ubuntu

Apr 23, 2018
Unscored —

CVE-2018-9363

In the hidp_process_report in bluetooth, there is an integer overflow. This could lead to an out of bounds write with n…

Google Android linux-raspi2 linux-hwe Android Debian Ubuntu

Nov 6, 2018

References

article
https://access.redhat.com/security/updates/classification/#important
article
https://access.redhat.com/articles/3553061
article
https://access.redhat.com/security/vulnerabilities/ssbd
article
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.6_release_notes/index
article
https://access.redhat.com/articles/3658021
report
https://bugzilla.redhat.com/show_bug.cgi?id=1516257
report
https://bugzilla.redhat.com/show_bug.cgi?id=1528312
report
https://bugzilla.redhat.com/show_bug.cgi?id=1528323
report
https://bugzilla.redhat.com/show_bug.cgi?id=1533909
report
https://bugzilla.redhat.com/show_bug.cgi?id=1539508
report
https://bugzilla.redhat.com/show_bug.cgi?id=1539706
report
https://bugzilla.redhat.com/show_bug.cgi?id=1541846
report
https://bugzilla.redhat.com/show_bug.cgi?id=1547824
report
https://bugzilla.redhat.com/show_bug.cgi?id=1548412
report
https://bugzilla.redhat.com/show_bug.cgi?id=1550142
report
https://bugzilla.redhat.com/show_bug.cgi?id=1551051
report
https://bugzilla.redhat.com/show_bug.cgi?id=1551565
report
https://bugzilla.redhat.com/show_bug.cgi?id=1552048
report
https://bugzilla.redhat.com/show_bug.cgi?id=1553361
report
https://bugzilla.redhat.com/show_bug.cgi?id=1560777
report
https://bugzilla.redhat.com/show_bug.cgi?id=1560788
report
https://bugzilla.redhat.com/show_bug.cgi?id=1560793
report
https://bugzilla.redhat.com/show_bug.cgi?id=1566890
report
https://bugzilla.redhat.com/show_bug.cgi?id=1568744
report
https://bugzilla.redhat.com/show_bug.cgi?id=1571062
report
https://bugzilla.redhat.com/show_bug.cgi?id=1571623
report
https://bugzilla.redhat.com/show_bug.cgi?id=1573699
report
https://bugzilla.redhat.com/show_bug.cgi?id=1575472
report
https://bugzilla.redhat.com/show_bug.cgi?id=1577408
report
https://bugzilla.redhat.com/show_bug.cgi?id=1583210
report
https://bugzilla.redhat.com/show_bug.cgi?id=1589324
report
https://bugzilla.redhat.com/show_bug.cgi?id=1590215
report
https://bugzilla.redhat.com/show_bug.cgi?id=1590799
report
https://bugzilla.redhat.com/show_bug.cgi?id=1596795
report
https://bugzilla.redhat.com/show_bug.cgi?id=1596802
report
https://bugzilla.redhat.com/show_bug.cgi?id=1596806
report
https://bugzilla.redhat.com/show_bug.cgi?id=1596812
report
https://bugzilla.redhat.com/show_bug.cgi?id=1596828
report
https://bugzilla.redhat.com/show_bug.cgi?id=1596842

Red Hat Security Advisory: kernel-alt security, bug fix, and enhancement update

Fixed packages 20

Vulnerabilities 42

Linux kernel ext4 filesystem is vulnerable to an out-of-bound access in the ext4_ext_drop_refs() function when operatin…

A security flaw was found in the ip_frag_reasm() function in net/ipv4/ip_fragment.c in the Linux kernel from 4.19-rc1 t…

A flaw was found in the crypto subsystem of the Linux kernel before version kernel-4.15-rc4. The "null skcipher" was be…

Linux kernel is vulnerable to a stack-out-of-bounds write in the ext4 filesystem code when mounting and writing to a cr…

Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addre…

A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bounds write and a denial of s…

A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound write in in fs/jbd2/tran…

A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bounds write in jbd2_journal_d…

A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause a use-after-free in ext4_xattr_set_entry…

A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound access in ext4_get_group…

A flaw was found affecting the Linux kernel before version 4.17. By mmap()ing a FUSE-backed file onto a process's memor…

Linux kernel vhost since version 4.8 does not properly initialize memory in messages passed between virtual guests and …

An elevation of privilege vulnerability in the kernel v4l2 video driver. Product: Android. Versions: Android kernel. An…

The dvb_frontend_free function in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel through 4.13.11 allows loca…

The Salsa20 encryption algorithm in the Linux kernel before 4.14.8 does not correctly handle zero-length inputs, allowi…

The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8 does not validate that the underlying cryptog…

crypto/pcrypt.c in the Linux kernel before 4.14.13 mishandles freeing instances, allowing a local user able to access t…

The madvise_willneed function in mm/madvise.c in the Linux kernel before 4.14.4 allows local users to cause a denial of…

The timer_create syscall implementation in kernel/time/posix-timers.c in the Linux kernel before 4.14.8 doesn't properl…

Linux Linux kernel version at least v4.8 onwards, probably well before contains a Insufficient input validation vulnera…

The Linux Kernel versions 4.14, 4.15, and 4.16 has a null pointer dereference which can result in an out of memory (OOM…

Linux Kernel version 3.18 to 4.16 incorrectly handles an SG_IO ioctl on /dev/sg0 with dxfer_direction=SG_DXFER_FROM_DEV…

The xfs_dinode_verify function in fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel through 4.16.3 allows local users t…

The netfilter subsystem in the Linux kernel through 4.15.7 mishandles the case of a rule blob that contains a jump but …

A flaw was found in the Linux 4.x kernel's implementation of 32-bit syscall interface for bridging. This allowed a priv…

The ext4_iget function in fs/ext4/inode.c in the Linux kernel through 4.15.15 mishandles the case of a root directory w…

The ext4_fill_super function in fs/ext4/super.c in the Linux kernel through 4.15.15 does not always initialize the crc3…

The cdrom_ioctl_media_changed function in drivers/cdrom/cdrom.c in the Linux kernel before 4.16.6 allows local attacker…

The ext4_xattr_check_entries function in fs/ext4/xattr.c in the Linux kernel through 4.15.15 does not properly validate…

The sr_do_ioctl function in drivers/scsi/sr_ioctl.c in the Linux kernel through 4.16.12 allows local users to cause a d…

In net/socket.c in the Linux kernel through 4.17.1, there is a race condition between fchownat and close in cases where…

The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an…

In the Linux kernel through 4.14.13, drivers/block/loop.c mishandles lo_release serialization, which allows attackers t…

Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service

The Linux kernel, versions 3.9+, IP implementation is vulnerable to denial of service conditions with low rates of specially modified packets

The acpi_smbus_hc_add function in drivers/acpi/sbshc.c in the Linux kernel through 4.14.15 allows local users to obtain…

In the Linux Kernel before version 4.15.8, 4.14.25, 4.9.87, 4.4.121, 4.1.51, and 3.2.102, an error in the "_sctp_make_c…

In the function wmi_set_ie(), the length validation code does not handle unsigned integer overflow properly. As a resul…

The Linux kernel 4.15 has a Buffer Overflow via an SNDRV_SEQ_IOCTL_SET_CLIENT_POOL ioctl write operation to /dev/snd/se…

Memory leak in the sas_smp_get_phy_events function in drivers/scsi/libsas/sas_expander.c in the Linux kernel through 4.…

The udl_fb_mmap function in drivers/gpu/drm/udl/udl_fb.c at the Linux kernel version 3.4 and up to and including 4.15 h…

In the hidp_process_report in bluetooth, there is an integer overflow. This could lead to an out of bounds write with n…

References