-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: kernel security and bug fix update
Advisory ID:       RHSA-2019:1170-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://access.redhat.com/errata/RHSA-2019:1170
Issue date:        2019-05-14
CVE Names:         CVE-2016-7913 CVE-2016-8633 CVE-2017-11600 
                   CVE-2017-12190 CVE-2017-13215 CVE-2017-16939 
                   CVE-2017-17558 CVE-2017-1000407 CVE-2018-1068 
                   CVE-2018-3665 CVE-2018-12126 CVE-2018-12127 
                   CVE-2018-12130 CVE-2018-18559 CVE-2019-11091 
=====================================================================

1. Summary:

An update for kernel is now available for Red Hat Enterprise Linux 7.4
Extended Update Support.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux ComputeNode EUS (v. 7.4) - noarch, x86_64
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.4) - x86_64
Red Hat Enterprise Linux Server EUS (v. 7.4) - noarch, ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Server Optional EUS (v. 7.4) - ppc64, ppc64le, x86_64

3. Description:

The kernel packages contain the Linux kernel, the core of any Linux
operating system.

Security Fix(es):

* A flaw was found in the implementation of the "fill buffer", a mechanism
used by modern CPUs when a cache-miss is made on L1 CPU cache. If an
attacker can generate a load operation that would create a page fault, the
execution will continue speculatively with incorrect data from the fill
buffer while the data is fetched from higher level caches. This response
time can be measured to infer data in the fill buffer. (CVE-2018-12130)

* Modern Intel microprocessors implement hardware-level micro-optimizations
to improve the performance of writing data back to CPU caches. The write
operation is split into STA (STore Address) and STD (STore Data)
sub-operations. These sub-operations allow the processor to hand-off
address generation logic into these sub-operations for optimized writes.
Both of these sub-operations write to a shared distributed processor
structure called the 'processor store buffer'. As a result, an unprivileged
attacker could use this flaw to read private data resident within the CPU's
processor store buffer. (CVE-2018-12126)

* Microprocessors use a ‘load port’ subcomponent to perform load operations
from memory or IO. During a load operation, the load port receives data
from the memory or IO subsystem and then provides the data to the CPU
registers and operations in the CPU’s pipelines. Stale load operations
results are stored in the 'load port' table until overwritten by newer
operations. Certain load-port operations triggered by an attacker can be
used to reveal data about previous stale requests leaking data back to the
attacker via a timing side-channel. (CVE-2018-12127)

* Uncacheable memory on some microprocessors utilizing speculative
execution may allow an authenticated user to potentially enable information
disclosure via a side channel with local access. (CVE-2019-11091)

* kernel: Buffer overflow in firewire driver via crafted incoming packets
(CVE-2016-8633)

* kernel: crypto: privilege escalation in skcipher_recvmsg function
(CVE-2017-13215)

* Kernel: ipsec: xfrm: use-after-free leading to potential privilege
escalation (CVE-2017-16939)

* kernel: Out-of-bounds write via userland offsets in ebt_entry struct in
netfilter/ebtables.c (CVE-2018-1068)

* kernel: Use-after-free due to race condition in AF_PACKET implementation
(CVE-2018-18559)

* kernel: media: use-after-free in [tuner-xc2028] media driver
(CVE-2016-7913)

* kernel: Out-of-bounds access via an XFRM_MSG_MIGRATE xfrm Netlink message
(CVE-2017-11600)

* kernel: memory leak when merging buffers in SCSI IO vectors
(CVE-2017-12190)

* kernel: Unallocated memory access by malicious USB device via
bNumInterfaces overflow (CVE-2017-17558)

* Kernel: KVM: DoS via write flood to I/O port 0x80 (CVE-2017-1000407)

* Kernel: FPU state information leakage via lazy FPU restore
(CVE-2018-3665)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Bug Fix(es):

* rwsem in inconsistent state leading system to hung (BZ#1690321)

* efi_bgrt_init fails to ioremap error during boot (BZ#1692284)

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

1391490 - CVE-2016-8633 kernel: Buffer overflow in firewire driver via crafted incoming packets
1402885 - CVE-2016-7913 kernel: media: use-after-free in [tuner-xc2028] media driver
1474928 - CVE-2017-11600 kernel: Out-of-bounds access via an XFRM_MSG_MIGRATE xfrm Netlink message
1495089 - CVE-2017-12190 kernel: memory leak when merging buffers in SCSI IO vectors
1517220 - CVE-2017-16939 Kernel: ipsec: xfrm: use-after-free leading to potential privilege escalation
1520328 - CVE-2017-1000407 Kernel: KVM: DoS via write flood to I/O port 0x80
1525474 - CVE-2017-17558 kernel: Unallocated memory access by malicious USB device via bNumInterfaces overflow
1535173 - CVE-2017-13215 kernel: crypto: privilege escalation in skcipher_recvmsg function
1552048 - CVE-2018-1068 kernel: Out-of-bounds write via userland offsets in ebt_entry struct in netfilter/ebtables.c
1585011 - CVE-2018-3665 Kernel: FPU state information leakage via lazy FPU restore
1641878 - CVE-2018-18559 kernel: Use-after-free due to race condition in AF_PACKET implementation
1646781 - CVE-2018-12126 hardware: Microarchitectural Store Buffer Data Sampling (MSBDS)
1646784 - CVE-2018-12130 hardware: Microarchitectural Fill Buffer Data Sampling (MFBDS)
1667782 - CVE-2018-12127 hardware: Micro-architectural Load Port Data Sampling - Information Leak (MLPDS)
1705312 - CVE-2019-11091 hardware: Microarchitectural Data Sampling Uncacheable Memory (MDSUM)

6. Package List:

Red Hat Enterprise Linux ComputeNode EUS (v. 7.4):

Source:
kernel-3.10.0-693.47.2.el7.src.rpm

noarch:
kernel-abi-whitelists-3.10.0-693.47.2.el7.noarch.rpm
kernel-doc-3.10.0-693.47.2.el7.noarch.rpm

x86_64:
kernel-3.10.0-693.47.2.el7.x86_64.rpm
kernel-debug-3.10.0-693.47.2.el7.x86_64.rpm
kernel-debug-debuginfo-3.10.0-693.47.2.el7.x86_64.rpm
kernel-debug-devel-3.10.0-693.47.2.el7.x86_64.rpm
kernel-debuginfo-3.10.0-693.47.2.el7.x86_64.rpm
kernel-debuginfo-common-x86_64-3.10.0-693.47.2.el7.x86_64.rpm
kernel-devel-3.10.0-693.47.2.el7.x86_64.rpm
kernel-headers-3.10.0-693.47.2.el7.x86_64.rpm
kernel-tools-3.10.0-693.47.2.el7.x86_64.rpm
kernel-tools-debuginfo-3.10.0-693.47.2.el7.x86_64.rpm
kernel-tools-libs-3.10.0-693.47.2.el7.x86_64.rpm
perf-3.10.0-693.47.2.el7.x86_64.rpm
perf-debuginfo-3.10.0-693.47.2.el7.x86_64.rpm
python-perf-3.10.0-693.47.2.el7.x86_64.rpm
python-perf-debuginfo-3.10.0-693.47.2.el7.x86_64.rpm

Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.4):

x86_64:
kernel-debug-debuginfo-3.10.0-693.47.2.el7.x86_64.rpm
kernel-debuginfo-3.10.0-693.47.2.el7.x86_64.rpm
kernel-debuginfo-common-x86_64-3.10.0-693.47.2.el7.x86_64.rpm
kernel-tools-debuginfo-3.10.0-693.47.2.el7.x86_64.rpm
kernel-tools-libs-devel-3.10.0-693.47.2.el7.x86_64.rpm
perf-debuginfo-3.10.0-693.47.2.el7.x86_64.rpm
python-perf-debuginfo-3.10.0-693.47.2.el7.x86_64.rpm

Red Hat Enterprise Linux Server EUS (v. 7.4):

Source:
kernel-3.10.0-693.47.2.el7.src.rpm

noarch:
kernel-abi-whitelists-3.10.0-693.47.2.el7.noarch.rpm
kernel-doc-3.10.0-693.47.2.el7.noarch.rpm

ppc64:
kernel-3.10.0-693.47.2.el7.ppc64.rpm
kernel-bootwrapper-3.10.0-693.47.2.el7.ppc64.rpm
kernel-debug-3.10.0-693.47.2.el7.ppc64.rpm
kernel-debug-debuginfo-3.10.0-693.47.2.el7.ppc64.rpm
kernel-debug-devel-3.10.0-693.47.2.el7.ppc64.rpm
kernel-debuginfo-3.10.0-693.47.2.el7.ppc64.rpm
kernel-debuginfo-common-ppc64-3.10.0-693.47.2.el7.ppc64.rpm
kernel-devel-3.10.0-693.47.2.el7.ppc64.rpm
kernel-headers-3.10.0-693.47.2.el7.ppc64.rpm
kernel-tools-3.10.0-693.47.2.el7.ppc64.rpm
kernel-tools-debuginfo-3.10.0-693.47.2.el7.ppc64.rpm
kernel-tools-libs-3.10.0-693.47.2.el7.ppc64.rpm
perf-3.10.0-693.47.2.el7.ppc64.rpm
perf-debuginfo-3.10.0-693.47.2.el7.ppc64.rpm
python-perf-3.10.0-693.47.2.el7.ppc64.rpm
python-perf-debuginfo-3.10.0-693.47.2.el7.ppc64.rpm

ppc64le:
kernel-3.10.0-693.47.2.el7.ppc64le.rpm
kernel-bootwrapper-3.10.0-693.47.2.el7.ppc64le.rpm
kernel-debug-3.10.0-693.47.2.el7.ppc64le.rpm
kernel-debug-debuginfo-3.10.0-693.47.2.el7.ppc64le.rpm
kernel-debuginfo-3.10.0-693.47.2.el7.ppc64le.rpm
kernel-debuginfo-common-ppc64le-3.10.0-693.47.2.el7.ppc64le.rpm
kernel-devel-3.10.0-693.47.2.el7.ppc64le.rpm
kernel-headers-3.10.0-693.47.2.el7.ppc64le.rpm
kernel-tools-3.10.0-693.47.2.el7.ppc64le.rpm
kernel-tools-debuginfo-3.10.0-693.47.2.el7.ppc64le.rpm
kernel-tools-libs-3.10.0-693.47.2.el7.ppc64le.rpm
perf-3.10.0-693.47.2.el7.ppc64le.rpm
perf-debuginfo-3.10.0-693.47.2.el7.ppc64le.rpm
python-perf-3.10.0-693.47.2.el7.ppc64le.rpm
python-perf-debuginfo-3.10.0-693.47.2.el7.ppc64le.rpm

s390x:
kernel-3.10.0-693.47.2.el7.s390x.rpm
kernel-debug-3.10.0-693.47.2.el7.s390x.rpm
kernel-debug-debuginfo-3.10.0-693.47.2.el7.s390x.rpm
kernel-debug-devel-3.10.0-693.47.2.el7.s390x.rpm
kernel-debuginfo-3.10.0-693.47.2.el7.s390x.rpm
kernel-debuginfo-common-s390x-3.10.0-693.47.2.el7.s390x.rpm
kernel-devel-3.10.0-693.47.2.el7.s390x.rpm
kernel-headers-3.10.0-693.47.2.el7.s390x.rpm
kernel-kdump-3.10.0-693.47.2.el7.s390x.rpm
kernel-kdump-debuginfo-3.10.0-693.47.2.el7.s390x.rpm
kernel-kdump-devel-3.10.0-693.47.2.el7.s390x.rpm
perf-3.10.0-693.47.2.el7.s390x.rpm
perf-debuginfo-3.10.0-693.47.2.el7.s390x.rpm
python-perf-3.10.0-693.47.2.el7.s390x.rpm
python-perf-debuginfo-3.10.0-693.47.2.el7.s390x.rpm

x86_64:
kernel-3.10.0-693.47.2.el7.x86_64.rpm
kernel-debug-3.10.0-693.47.2.el7.x86_64.rpm
kernel-debug-debuginfo-3.10.0-693.47.2.el7.x86_64.rpm
kernel-debug-devel-3.10.0-693.47.2.el7.x86_64.rpm
kernel-debuginfo-3.10.0-693.47.2.el7.x86_64.rpm
kernel-debuginfo-common-x86_64-3.10.0-693.47.2.el7.x86_64.rpm
kernel-devel-3.10.0-693.47.2.el7.x86_64.rpm
kernel-headers-3.10.0-693.47.2.el7.x86_64.rpm
kernel-tools-3.10.0-693.47.2.el7.x86_64.rpm
kernel-tools-debuginfo-3.10.0-693.47.2.el7.x86_64.rpm
kernel-tools-libs-3.10.0-693.47.2.el7.x86_64.rpm
perf-3.10.0-693.47.2.el7.x86_64.rpm
perf-debuginfo-3.10.0-693.47.2.el7.x86_64.rpm
python-perf-3.10.0-693.47.2.el7.x86_64.rpm
python-perf-debuginfo-3.10.0-693.47.2.el7.x86_64.rpm

Red Hat Enterprise Linux Server Optional EUS (v. 7.4):

ppc64:
kernel-debug-debuginfo-3.10.0-693.47.2.el7.ppc64.rpm
kernel-debuginfo-3.10.0-693.47.2.el7.ppc64.rpm
kernel-debuginfo-common-ppc64-3.10.0-693.47.2.el7.ppc64.rpm
kernel-tools-debuginfo-3.10.0-693.47.2.el7.ppc64.rpm
kernel-tools-libs-devel-3.10.0-693.47.2.el7.ppc64.rpm
perf-debuginfo-3.10.0-693.47.2.el7.ppc64.rpm
python-perf-debuginfo-3.10.0-693.47.2.el7.ppc64.rpm

ppc64le:
kernel-debug-debuginfo-3.10.0-693.47.2.el7.ppc64le.rpm
kernel-debug-devel-3.10.0-693.47.2.el7.ppc64le.rpm
kernel-debuginfo-3.10.0-693.47.2.el7.ppc64le.rpm
kernel-debuginfo-common-ppc64le-3.10.0-693.47.2.el7.ppc64le.rpm
kernel-tools-debuginfo-3.10.0-693.47.2.el7.ppc64le.rpm
kernel-tools-libs-devel-3.10.0-693.47.2.el7.ppc64le.rpm
perf-debuginfo-3.10.0-693.47.2.el7.ppc64le.rpm
python-perf-debuginfo-3.10.0-693.47.2.el7.ppc64le.rpm

x86_64:
kernel-debug-debuginfo-3.10.0-693.47.2.el7.x86_64.rpm
kernel-debuginfo-3.10.0-693.47.2.el7.x86_64.rpm
kernel-debuginfo-common-x86_64-3.10.0-693.47.2.el7.x86_64.rpm
kernel-tools-debuginfo-3.10.0-693.47.2.el7.x86_64.rpm
kernel-tools-libs-devel-3.10.0-693.47.2.el7.x86_64.rpm
perf-debuginfo-3.10.0-693.47.2.el7.x86_64.rpm
python-perf-debuginfo-3.10.0-693.47.2.el7.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2016-7913
https://access.redhat.com/security/cve/CVE-2016-8633
https://access.redhat.com/security/cve/CVE-2017-11600
https://access.redhat.com/security/cve/CVE-2017-12190
https://access.redhat.com/security/cve/CVE-2017-13215
https://access.redhat.com/security/cve/CVE-2017-16939
https://access.redhat.com/security/cve/CVE-2017-17558
https://access.redhat.com/security/cve/CVE-2017-1000407
https://access.redhat.com/security/cve/CVE-2018-1068
https://access.redhat.com/security/cve/CVE-2018-3665
https://access.redhat.com/security/cve/CVE-2018-12126
https://access.redhat.com/security/cve/CVE-2018-12127
https://access.redhat.com/security/cve/CVE-2018-12130
https://access.redhat.com/security/cve/CVE-2018-18559
https://access.redhat.com/security/cve/CVE-2019-11091
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/security/vulnerabilities/mds

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2019 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBXNsSadzjgjWX9erEAQgP9w//UOww3aPtqTYiBUzHHXgpOdxbU3bUjQo9
AL+l/A6WPXAz/RJpSMuxliNuRj9MXSZCHqn1cnalTIZfJGh58wIZEi3Nh/NYbHDd
b4HFEy2CoaFJ24aiLC+hheslmgsXLxyx334lrNq+o/t48KKC5dfuOSta+g9+y6XG
7SugZR/GCgZUj0DdLaEmCdLcla9unxiegRACUgMatTzZQTI3h/nQWkRF5D0Vwq+g
hz/5+p5HCUJTr9n/5el5Q12AipHkzVjakiGbjK1NCoPiRVHRKo+no0tRQsx+a0kN
H/vL2QevSYv2RGNrtKX0irAMmQvccaaapvX3rDR/7Pyk+QdZz2d8SbPIec5xsvm3
52g+jqL/gQKP4dNch37LVfCiNPHt/IjEBHjy2dES6Q2uXPdL6OjT1++ygN96l3yu
bJeNcbBVDxLoZR8w7yrNoRDjR06y2fo7Q8Gvw/BjyXe7Ka/gNGBujHroAvgQVGPi
K92PQlnnKzTwzkQ0G6i/klPzyh07yqmH/vpygphFUcHztiLCQ26DpPamc0PFwXAs
URu1erbnWsl4HPlvzu3vMIdZEkwN8CUr1rj9a140N05+jhjhDqXb+gzq+DpSYhR3
T4W8Vq9CFczOm0wY4VojDEyPQuHuheg49lzshwnr65r77vWWNfZlo6BwmK/uRT8d
mS+Mf+im58s=
=ebla
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce