RHSA-2019:2043 — Red Hat Security Advisory: kernel-rt security and bug fix update

Fixed packages 17

Release	Package	Fixed in
Red Hat · RHEL 7 rhel_extras_rt:7	kernel-rt	0:3.10.0-1062.rt56.1022.el7
Red Hat · RHEL 7 rhel_extras_rt:7	kernel-rt-debug	0:3.10.0-1062.rt56.1022.el7
Red Hat · RHEL 7 rhel_extras_rt:7	kernel-rt-debug-debuginfo	0:3.10.0-1062.rt56.1022.el7
Red Hat · RHEL 7 rhel_extras_rt:7	kernel-rt-debug-devel	0:3.10.0-1062.rt56.1022.el7
Red Hat · RHEL 7 rhel_extras_rt:7	kernel-rt-debug-kvm	0:3.10.0-1062.rt56.1022.el7
Red Hat · RHEL 7 rhel_extras_rt:7	kernel-rt-debug-kvm-debuginfo	0:3.10.0-1062.rt56.1022.el7
Red Hat · RHEL 7 rhel_extras_rt:7	kernel-rt-debuginfo	0:3.10.0-1062.rt56.1022.el7
Red Hat · RHEL 7 rhel_extras_rt:7	kernel-rt-debuginfo-common-x86_64	0:3.10.0-1062.rt56.1022.el7
Red Hat · RHEL 7 rhel_extras_rt:7	kernel-rt-devel	0:3.10.0-1062.rt56.1022.el7
Red Hat · RHEL 7 rhel_extras_rt:7	kernel-rt-doc	0:3.10.0-1062.rt56.1022.el7
Red Hat · RHEL 7 rhel_extras_rt:7	kernel-rt-kvm	0:3.10.0-1062.rt56.1022.el7
Red Hat · RHEL 7 rhel_extras_rt:7	kernel-rt-kvm-debuginfo	0:3.10.0-1062.rt56.1022.el7
Red Hat · RHEL 7 rhel_extras_rt:7	kernel-rt-trace	0:3.10.0-1062.rt56.1022.el7
Red Hat · RHEL 7 rhel_extras_rt:7	kernel-rt-trace-debuginfo	0:3.10.0-1062.rt56.1022.el7
Red Hat · RHEL 7 rhel_extras_rt:7	kernel-rt-trace-devel	0:3.10.0-1062.rt56.1022.el7
Red Hat · RHEL 7 rhel_extras_rt:7	kernel-rt-trace-kvm	0:3.10.0-1062.rt56.1022.el7
Red Hat · RHEL 7 rhel_extras_rt:7	kernel-rt-trace-kvm-debuginfo	0:3.10.0-1062.rt56.1022.el7

Vulnerabilities 27

High 7.0

CVE-2018-10853

A flaw was found in the way Linux kernel KVM hypervisor before 4.18 emulated instructions such as sgdt/sidt/fxsave/fxrs…

Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu

Sep 11, 2018
Medium 6.3

CVE-2019-3900

An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including v5.1-rc6, while han…

Red Hat kernel linux-raspi2 linux-hwe Debian Ubuntu

Apr 25, 2019
Medium 5.5

CVE-2019-10140

A vulnerability was found in Linux kernel's, versions up to 3.10, implementation of overlayfs. An attacker with local a…

OpenSource kernel:

Aug 15, 2019
Medium 5.3

CVE-2018-14625

A flaw was found in the Linux Kernel where an attacker may be able to have an uncontrolled read to kernel-memory from w…

[UNKNOWN] kernel: linux-raspi2 linux-hwe Debian Ubuntu

Sep 10, 2018
Medium 4.7

CVE-2018-16885

A flaw was found in the Linux kernel that allows the userspace to call memcpy_fromiovecend() and similar functions with…

The Linux Foundation Kernel linux Debian

Jan 3, 2019
Medium 4.7

CVE-2019-3882

A flaw was found in the Linux kernel's vfio interface implementation that permits violation of the user's locked memory…

The Linux Foundation Kernel linux-raspi2 linux-hwe Debian Ubuntu

Apr 24, 2019
Unscored —

CVE-2018-13053

The alarm_timer_nsleep function in kernel/time/alarmtimer.c in the Linux kernel through 4.17.3 has an integer overflow …

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Jul 2, 2018
Unscored —

CVE-2018-13093

An issue was discovered in fs/xfs/xfs_icache.c in the Linux kernel through 4.17.3. There is a NULL pointer dereference …

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Jul 3, 2018
Unscored —

CVE-2018-13094

An issue was discovered in fs/xfs/libxfs/xfs_attr_leaf.c in the Linux kernel through 4.17.3. An OOPS may occur for a co…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Jul 3, 2018
Unscored —

CVE-2018-13095

An issue was discovered in fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel through 4.17.3. A denial of service (memor…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Jul 3, 2018
Unscored —

CVE-2018-14734

drivers/infiniband/core/ucma.c in the Linux kernel through 4.17.11 allows ucma_leave_multicast to access a certain data…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Jul 29, 2018
Unscored —

CVE-2018-15594

arch/x86/kernel/paravirt.c in the Linux kernel before 4.18.1 mishandles certain indirect calls, which makes it easier f…

linux-raspi2 linux-hwe linux-azure linux-gcp Debian Ubuntu

Aug 20, 2018
Unscored —

CVE-2018-16658

An issue was discovered in the Linux kernel before 4.18.6. An information leak in cdrom_ioctl_drive_status in drivers/c…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Sep 7, 2018
Unscored —

CVE-2018-18281

Since Linux kernel version 3.2, the mremap() syscall performs TLB flushes after dropping pagetable locks. If a syscall …

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Oct 30, 2018
Unscored —

CVE-2018-7755

An issue was discovered in the fd_locked_ioctl function in drivers/block/floppy.c in the Linux kernel through 4.15.7. T…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Mar 8, 2018
Unscored —

CVE-2018-8087

Memory leak in the hwsim_new_radio_nl function in drivers/net/wireless/mac80211_hwsim.c in the Linux kernel through 4.1…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Mar 13, 2018
Unscored —

CVE-2018-9363

In the hidp_process_report in bluetooth, there is an integer overflow. This could lead to an out of bounds write with n…

Google Android linux-raspi2 linux-hwe Android Debian Ubuntu

Nov 6, 2018
Unscored —

CVE-2018-9516

In hid_debug_events_read of drivers/hid/hid-debug.c, there is a possible out of bounds write due to a missing bounds ch…

Google Android linux-raspi2 linux-hwe Android Debian Ubuntu

Nov 6, 2018
Unscored —

CVE-2018-9517

In pppol2tp_connect, there is possible memory corruption due to a use after free. This could lead to local escalation o…

Google Android linux-raspi2 linux-hwe Android Debian Ubuntu

Dec 7, 2018
Unscored —

CVE-2019-11599 Public exploit

The coredump implementation in the Linux kernel before 5.0.10 does not use locking or other mechanisms to prevent vma l…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Apr 29, 2019
Unscored —

CVE-2019-11810

An issue was discovered in the Linux kernel before 5.0.7. A NULL pointer dereference can occur when megasas_create_fram…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

May 7, 2019
Unscored —

CVE-2019-11833

fs/ext4/extents.c in the Linux kernel through 5.1.2 does not zero out the unused memory region in the extent tree block…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

May 15, 2019
Unscored —

CVE-2019-3459

A heap address information leak while using L2CAP_GET_CONF_OPT was discovered in the Linux kernel before 5.1-rc1.

Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

Apr 11, 2019
Unscored —

CVE-2019-3460

A heap data infoleak in multiple locations including L2CAP_PARSE_CONF_RSP was found in the Linux kernel before 5.1-rc1.

Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

Apr 11, 2019
Unscored —

CVE-2019-5489 Public exploit

The mincore() implementation in mm/mincore.c in the Linux kernel through 4.19.13 allowed local attackers to observe pag…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Jan 7, 2019
Unscored —

CVE-2019-7222

The KVM implementation in the Linux kernel through 4.20.5 has an Information Leak.

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Mar 17, 2019
Unscored —

CVE-2019-9456

In the Android kernel in Pixel C USB monitor driver there is a possible OOB write due to a missing bounds check. This c…

linux-raspi2 linux-hwe linux-azure linux-riscv Android Debian Ubuntu

Sep 6, 2019

References

article
https://access.redhat.com/security/updates/classification/#important
article
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html-single/7.7_release_notes/index
report
https://bugzilla.redhat.com/show_bug.cgi?id=1553216
report
https://bugzilla.redhat.com/show_bug.cgi?id=1555145
report
https://bugzilla.redhat.com/show_bug.cgi?id=1573916
report
https://bugzilla.redhat.com/show_bug.cgi?id=1589890
report
https://bugzilla.redhat.com/show_bug.cgi?id=1593361
report
https://bugzilla.redhat.com/show_bug.cgi?id=1597747
report
https://bugzilla.redhat.com/show_bug.cgi?id=1597766
report
https://bugzilla.redhat.com/show_bug.cgi?id=1597771
report
https://bugzilla.redhat.com/show_bug.cgi?id=1597775
report
https://bugzilla.redhat.com/show_bug.cgi?id=1611005
report
https://bugzilla.redhat.com/show_bug.cgi?id=1619846
report
https://bugzilla.redhat.com/show_bug.cgi?id=1620555
report
https://bugzilla.redhat.com/show_bug.cgi?id=1623067
report
https://bugzilla.redhat.com/show_bug.cgi?id=1627731
report
https://bugzilla.redhat.com/show_bug.cgi?id=1631036
report
https://bugzilla.redhat.com/show_bug.cgi?id=1631045
report
https://bugzilla.redhat.com/show_bug.cgi?id=1642619
report
https://bugzilla.redhat.com/show_bug.cgi?id=1645121
report
https://bugzilla.redhat.com/show_bug.cgi?id=1661503
report
https://bugzilla.redhat.com/show_bug.cgi?id=1663176
report
https://bugzilla.redhat.com/show_bug.cgi?id=1663179
report
https://bugzilla.redhat.com/show_bug.cgi?id=1664110
report
https://bugzilla.redhat.com/show_bug.cgi?id=1664380
report
https://bugzilla.redhat.com/show_bug.cgi?id=1665278
report
https://bugzilla.redhat.com/show_bug.cgi?id=1671126
report
https://bugzilla.redhat.com/show_bug.cgi?id=1671930
report
https://bugzilla.redhat.com/show_bug.cgi?id=1684745
report
https://bugzilla.redhat.com/show_bug.cgi?id=1689426
report
https://bugzilla.redhat.com/show_bug.cgi?id=1698757
report
https://bugzilla.redhat.com/show_bug.cgi?id=1705937
report
https://bugzilla.redhat.com/show_bug.cgi?id=1709164
report
https://bugzilla.redhat.com/show_bug.cgi?id=1712072
report
https://bugzilla.redhat.com/show_bug.cgi?id=1717212
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2043.json
report
https://access.redhat.com/security/cve/CVE-2018-7755
advisory
https://www.cve.org/CVERecord?id=CVE-2018-7755
advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-7755

Red Hat Security Advisory: kernel-rt security and bug fix update

Fixed packages 17

Vulnerabilities 27

A flaw was found in the way Linux kernel KVM hypervisor before 4.18 emulated instructions such as sgdt/sidt/fxsave/fxrs…

An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including v5.1-rc6, while han…

A vulnerability was found in Linux kernel's, versions up to 3.10, implementation of overlayfs. An attacker with local a…

A flaw was found in the Linux Kernel where an attacker may be able to have an uncontrolled read to kernel-memory from w…

A flaw was found in the Linux kernel that allows the userspace to call memcpy_fromiovecend() and similar functions with…

A flaw was found in the Linux kernel's vfio interface implementation that permits violation of the user's locked memory…

The alarm_timer_nsleep function in kernel/time/alarmtimer.c in the Linux kernel through 4.17.3 has an integer overflow …

An issue was discovered in fs/xfs/xfs_icache.c in the Linux kernel through 4.17.3. There is a NULL pointer dereference …

An issue was discovered in fs/xfs/libxfs/xfs_attr_leaf.c in the Linux kernel through 4.17.3. An OOPS may occur for a co…

An issue was discovered in fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel through 4.17.3. A denial of service (memor…

drivers/infiniband/core/ucma.c in the Linux kernel through 4.17.11 allows ucma_leave_multicast to access a certain data…

arch/x86/kernel/paravirt.c in the Linux kernel before 4.18.1 mishandles certain indirect calls, which makes it easier f…

An issue was discovered in the Linux kernel before 4.18.6. An information leak in cdrom_ioctl_drive_status in drivers/c…

Since Linux kernel version 3.2, the mremap() syscall performs TLB flushes after dropping pagetable locks. If a syscall …

An issue was discovered in the fd_locked_ioctl function in drivers/block/floppy.c in the Linux kernel through 4.15.7. T…

Memory leak in the hwsim_new_radio_nl function in drivers/net/wireless/mac80211_hwsim.c in the Linux kernel through 4.1…

In the hidp_process_report in bluetooth, there is an integer overflow. This could lead to an out of bounds write with n…

In hid_debug_events_read of drivers/hid/hid-debug.c, there is a possible out of bounds write due to a missing bounds ch…

In pppol2tp_connect, there is possible memory corruption due to a use after free. This could lead to local escalation o…

The coredump implementation in the Linux kernel before 5.0.10 does not use locking or other mechanisms to prevent vma l…

An issue was discovered in the Linux kernel before 5.0.7. A NULL pointer dereference can occur when megasas_create_fram…

fs/ext4/extents.c in the Linux kernel through 5.1.2 does not zero out the unused memory region in the extent tree block…

A heap address information leak while using L2CAP_GET_CONF_OPT was discovered in the Linux kernel before 5.1-rc1.

A heap data infoleak in multiple locations including L2CAP_PARSE_CONF_RSP was found in the Linux kernel before 5.1-rc1.

The mincore() implementation in mm/mincore.c in the Linux kernel through 4.19.13 allowed local attackers to observe pag…

The KVM implementation in the Linux kernel through 4.20.5 has an Information Leak.

In the Android kernel in Pixel C USB monitor driver there is a possible OOB write due to a missing bounds check. This c…

References