-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================                   Red Hat Security Advisory

Synopsis:          Important: kernel-alt security and bug fix update
Advisory ID:       RHSA-2020:0740-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://access.redhat.com/errata/RHSA-2020:0740
Issue date:        2020-03-09
CVE Names:         CVE-2018-16871 CVE-2019-3459 CVE-2019-3460 
                   CVE-2019-11884 CVE-2019-15030 CVE-2019-15916 
                   CVE-2019-17666 CVE-2019-18805 
====================================================================
1. Summary:

An update for kernel-alt is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) - aarch64, noarch, ppc64le, s390x
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) - aarch64, noarch, ppc64le

3. Description:

The kernel-alt packages provide the Linux kernel version 4.x.

Security Fix(es):

* kernel: rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in
the Linux kernel lacks a certain upper-bound check, leading to a buffer
overflow (CVE-2019-17666)

* kernel: nfs: NULL pointer dereference due to an anomalized NFS message
sequence (CVE-2018-16871)

* kernel: Heap address information leak while using L2CAP_GET_CONF_OPT
(CVE-2019-3459)

* kernel: Heap address information leak while using L2CAP_PARSE_CONF_RSP
(CVE-2019-3460)

* kernel: sensitive information disclosure from kernel stack memory via
HIDPCONNADD command (CVE-2019-11884)

* kernel: powerpc: local user can read vector registers of other users'
processes via a Facility Unavailable exception (CVE-2019-15030)

* kernel: memory leak in register_queue_kobjects() in net/core/net-sysfs.c
leads to denial of service (CVE-2019-15916)

* kernel: integer overflow in tcp_ack_update_rtt in net/ipv4/tcp_input.c
(CVE-2019-18805)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Bug Fix(es):

* lpfc: NVMe/FC target test machine rhel-storage-62 crashes on boot when
connected to FC switch (BZ#1623205)

* kernel BUG at fs/nfs_common/grace.c:107! (BZ#1637543)

* RHEL-Alt-7.6 - Need a fix for kernel bug cap_inode_getsecurity: use
d_find_any_alias() instead of d_find_alias() (BZ#1711934)

* Backport "fs/dcache.c: add cond_resched() in shrink_dentry_list()"
(32785c0539b7) [rhel-alt-7.6.z] (BZ#1758861)

* [RHEL-ALT-7.6.z][arm64] iommu/iova: Fix tracking of recently failed iova
address (BZ#1780500)

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

1655162 - CVE-2018-16871 kernel: nfs: NULL pointer dereference due to an anomalized NFS message sequence
1663176 - CVE-2019-3459 kernel: Heap address information leak while using L2CAP_GET_CONF_OPT
1663179 - CVE-2019-3460 kernel: Heap address information leak while using L2CAP_PARSE_CONF_RSP
1709837 - CVE-2019-11884 kernel: sensitive information disclosure from kernel stack memory via HIDPCONNADD command
1750813 - CVE-2019-15916 kernel: memory leak in register_queue_kobjects() in net/core/net-sysfs.c leads to denial of service
1759313 - CVE-2019-15030 kernel: powerpc: local user can read vector registers of other users' processes via a Facility Unavailable exception
1763690 - CVE-2019-17666 kernel: rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel lacks a certain upper-bound check, leading to a buffer overflow
1771496 - CVE-2019-18805 kernel: integer overflow in tcp_ack_update_rtt in net/ipv4/tcp_input.c

6. Package List:

Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7):

Source:
kernel-alt-4.14.0-115.18.1.el7a.src.rpm

aarch64:
kernel-4.14.0-115.18.1.el7a.aarch64.rpm
kernel-debug-4.14.0-115.18.1.el7a.aarch64.rpm
kernel-debug-debuginfo-4.14.0-115.18.1.el7a.aarch64.rpm
kernel-debug-devel-4.14.0-115.18.1.el7a.aarch64.rpm
kernel-debuginfo-4.14.0-115.18.1.el7a.aarch64.rpm
kernel-debuginfo-common-aarch64-4.14.0-115.18.1.el7a.aarch64.rpm
kernel-devel-4.14.0-115.18.1.el7a.aarch64.rpm
kernel-headers-4.14.0-115.18.1.el7a.aarch64.rpm
kernel-tools-4.14.0-115.18.1.el7a.aarch64.rpm
kernel-tools-debuginfo-4.14.0-115.18.1.el7a.aarch64.rpm
kernel-tools-libs-4.14.0-115.18.1.el7a.aarch64.rpm
perf-4.14.0-115.18.1.el7a.aarch64.rpm
perf-debuginfo-4.14.0-115.18.1.el7a.aarch64.rpm
python-perf-4.14.0-115.18.1.el7a.aarch64.rpm
python-perf-debuginfo-4.14.0-115.18.1.el7a.aarch64.rpm

noarch:
kernel-abi-whitelists-4.14.0-115.18.1.el7a.noarch.rpm
kernel-doc-4.14.0-115.18.1.el7a.noarch.rpm

ppc64le:
kernel-4.14.0-115.18.1.el7a.ppc64le.rpm
kernel-bootwrapper-4.14.0-115.18.1.el7a.ppc64le.rpm
kernel-debug-4.14.0-115.18.1.el7a.ppc64le.rpm
kernel-debug-debuginfo-4.14.0-115.18.1.el7a.ppc64le.rpm
kernel-debuginfo-4.14.0-115.18.1.el7a.ppc64le.rpm
kernel-debuginfo-common-ppc64le-4.14.0-115.18.1.el7a.ppc64le.rpm
kernel-devel-4.14.0-115.18.1.el7a.ppc64le.rpm
kernel-headers-4.14.0-115.18.1.el7a.ppc64le.rpm
kernel-tools-4.14.0-115.18.1.el7a.ppc64le.rpm
kernel-tools-debuginfo-4.14.0-115.18.1.el7a.ppc64le.rpm
kernel-tools-libs-4.14.0-115.18.1.el7a.ppc64le.rpm
perf-4.14.0-115.18.1.el7a.ppc64le.rpm
perf-debuginfo-4.14.0-115.18.1.el7a.ppc64le.rpm
python-perf-4.14.0-115.18.1.el7a.ppc64le.rpm
python-perf-debuginfo-4.14.0-115.18.1.el7a.ppc64le.rpm

s390x:
kernel-4.14.0-115.18.1.el7a.s390x.rpm
kernel-debug-4.14.0-115.18.1.el7a.s390x.rpm
kernel-debug-debuginfo-4.14.0-115.18.1.el7a.s390x.rpm
kernel-debug-devel-4.14.0-115.18.1.el7a.s390x.rpm
kernel-debuginfo-4.14.0-115.18.1.el7a.s390x.rpm
kernel-debuginfo-common-s390x-4.14.0-115.18.1.el7a.s390x.rpm
kernel-devel-4.14.0-115.18.1.el7a.s390x.rpm
kernel-headers-4.14.0-115.18.1.el7a.s390x.rpm
kernel-kdump-4.14.0-115.18.1.el7a.s390x.rpm
kernel-kdump-debuginfo-4.14.0-115.18.1.el7a.s390x.rpm
kernel-kdump-devel-4.14.0-115.18.1.el7a.s390x.rpm
perf-4.14.0-115.18.1.el7a.s390x.rpm
perf-debuginfo-4.14.0-115.18.1.el7a.s390x.rpm
python-perf-4.14.0-115.18.1.el7a.s390x.rpm
python-perf-debuginfo-4.14.0-115.18.1.el7a.s390x.rpm

Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7):

aarch64:
kernel-debug-debuginfo-4.14.0-115.18.1.el7a.aarch64.rpm
kernel-debuginfo-4.14.0-115.18.1.el7a.aarch64.rpm
kernel-debuginfo-common-aarch64-4.14.0-115.18.1.el7a.aarch64.rpm
kernel-tools-debuginfo-4.14.0-115.18.1.el7a.aarch64.rpm
kernel-tools-libs-devel-4.14.0-115.18.1.el7a.aarch64.rpm
perf-debuginfo-4.14.0-115.18.1.el7a.aarch64.rpm
python-perf-debuginfo-4.14.0-115.18.1.el7a.aarch64.rpm

noarch:
kernel-doc-4.14.0-115.18.1.el7a.noarch.rpm

ppc64le:
kernel-debug-debuginfo-4.14.0-115.18.1.el7a.ppc64le.rpm
kernel-debug-devel-4.14.0-115.18.1.el7a.ppc64le.rpm
kernel-debuginfo-4.14.0-115.18.1.el7a.ppc64le.rpm
kernel-debuginfo-common-ppc64le-4.14.0-115.18.1.el7a.ppc64le.rpm
kernel-tools-debuginfo-4.14.0-115.18.1.el7a.ppc64le.rpm
kernel-tools-libs-devel-4.14.0-115.18.1.el7a.ppc64le.rpm
perf-debuginfo-4.14.0-115.18.1.el7a.ppc64le.rpm
python-perf-debuginfo-4.14.0-115.18.1.el7a.ppc64le.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2018-16871
https://access.redhat.com/security/cve/CVE-2019-3459
https://access.redhat.com/security/cve/CVE-2019-3460
https://access.redhat.com/security/cve/CVE-2019-11884
https://access.redhat.com/security/cve/CVE-2019-15030
https://access.redhat.com/security/cve/CVE-2019-15916
https://access.redhat.com/security/cve/CVE-2019-17666
https://access.redhat.com/security/cve/CVE-2019-18805
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2020 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBXmZTZ9zjgjWX9erEAQimWg//Zc9mLHi7shOqwqI4c4/r4fO7fDki9y3D
cacCjjMIwOStipgK/iBkQICVw3htP/SnFUTX2QU2OmDSwXWNVo8X0p/QAF9ds1Un
rlRDV0FM/E2D9+EvLAW/QI9L07flpSYZBkzWTye91zqrW0FH5PC7IngUu5Hmx/a4
xL+yHhCTQyD9M9+Aju6B7VNn8R8/Gd0I8GK3zpX/4MUlidcEXBn/SVhchh9w3P4m
BeLCqqxzRTGOuEl7lgYBXpCV6whVEa9Ge1Y/i1Hf7rJ71Iw9sqP44RlNdSgUzoWo
wuyDt159SQCYjLAa9G4UnPzZ8AQLfKUd8udLQP9dsLUevzUPQ8o+mZ9DvLA8rO9e
pGYCDoyY7GzvojuxCRLF20nvJ8YmR4EpZR+q+Rmtox6Ntc/CmY7OUs/gy9dPoZOi
D+ogp2IWd2P7eN4LJ/9TGv33xdA/ytO+3z911YKv87RIurpuIt0H0nRHwlX08MwN
7PqPjVlEERhFSswz7KWvzqH5gkmn3k9zxus3ujo6fV4DkXylDz35KIKwhwBrWQYl
PAavvmjggK+VENUXVx2uF9E+uD8WnenW6oNE5COOyDkkqJYIAd78NhbA90MiRLF7
gFzpxdvNZGg8gDFnrqTMclV6Uqe2THJ0r+p9P2F56a8MFlAF6Uvx8NaugQYW0GfB
Qqq844SSE9I=B95R
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2020-0740:01 Important: kernel-alt security and bug fix update

An update for kernel-alt is now available for Red Hat Enterprise Linux 7

Summary

The kernel-alt packages provide the Linux kernel version 4.x.
Security Fix(es):
* kernel: rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel lacks a certain upper-bound check, leading to a buffer overflow (CVE-2019-17666)
* kernel: nfs: NULL pointer dereference due to an anomalized NFS message sequence (CVE-2018-16871)
* kernel: Heap address information leak while using L2CAP_GET_CONF_OPT (CVE-2019-3459)
* kernel: Heap address information leak while using L2CAP_PARSE_CONF_RSP (CVE-2019-3460)
* kernel: sensitive information disclosure from kernel stack memory via HIDPCONNADD command (CVE-2019-11884)
* kernel: powerpc: local user can read vector registers of other users' processes via a Facility Unavailable exception (CVE-2019-15030)
* kernel: memory leak in register_queue_kobjects() in net/core/net-sysfs.c leads to denial of service (CVE-2019-15916)
* kernel: integer overflow in tcp_ack_update_rtt in net/ipv4/tcp_input.c (CVE-2019-18805)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
* lpfc: NVMe/FC target test machine rhel-storage-62 crashes on boot when connected to FC switch (BZ#1623205)
* kernel BUG at fs/nfs_common/grace.c:107! (BZ#1637543)
* RHEL-Alt-7.6 - Need a fix for kernel bug cap_inode_getsecurity: use d_find_any_alias() instead of d_find_alias() (BZ#1711934)
* Backport "fs/dcache.c: add cond_resched() in shrink_dentry_list()" (32785c0539b7) [rhel-alt-7.6.z] (BZ#1758861)
* [RHEL-ALT-7.6.z][arm64] iommu/iova: Fix tracking of recently failed iova address (BZ#1780500)

Summary

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
The system must be rebooted for this update to take effect.

References

https://access.redhat.com/security/cve/CVE-2018-16871 https://access.redhat.com/security/cve/CVE-2019-3459 https://access.redhat.com/security/cve/CVE-2019-3460 https://access.redhat.com/security/cve/CVE-2019-11884 https://access.redhat.com/security/cve/CVE-2019-15030 https://access.redhat.com/security/cve/CVE-2019-15916 https://access.redhat.com/security/cve/CVE-2019-17666 https://access.redhat.com/security/cve/CVE-2019-18805 https://access.redhat.com/security/updates/classification/#important

Package List

Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7):
Source: kernel-alt-4.14.0-115.18.1.el7a.src.rpm
aarch64: kernel-4.14.0-115.18.1.el7a.aarch64.rpm kernel-debug-4.14.0-115.18.1.el7a.aarch64.rpm kernel-debug-debuginfo-4.14.0-115.18.1.el7a.aarch64.rpm kernel-debug-devel-4.14.0-115.18.1.el7a.aarch64.rpm kernel-debuginfo-4.14.0-115.18.1.el7a.aarch64.rpm kernel-debuginfo-common-aarch64-4.14.0-115.18.1.el7a.aarch64.rpm kernel-devel-4.14.0-115.18.1.el7a.aarch64.rpm kernel-headers-4.14.0-115.18.1.el7a.aarch64.rpm kernel-tools-4.14.0-115.18.1.el7a.aarch64.rpm kernel-tools-debuginfo-4.14.0-115.18.1.el7a.aarch64.rpm kernel-tools-libs-4.14.0-115.18.1.el7a.aarch64.rpm perf-4.14.0-115.18.1.el7a.aarch64.rpm perf-debuginfo-4.14.0-115.18.1.el7a.aarch64.rpm python-perf-4.14.0-115.18.1.el7a.aarch64.rpm python-perf-debuginfo-4.14.0-115.18.1.el7a.aarch64.rpm
noarch: kernel-abi-whitelists-4.14.0-115.18.1.el7a.noarch.rpm kernel-doc-4.14.0-115.18.1.el7a.noarch.rpm
ppc64le: kernel-4.14.0-115.18.1.el7a.ppc64le.rpm kernel-bootwrapper-4.14.0-115.18.1.el7a.ppc64le.rpm kernel-debug-4.14.0-115.18.1.el7a.ppc64le.rpm kernel-debug-debuginfo-4.14.0-115.18.1.el7a.ppc64le.rpm kernel-debuginfo-4.14.0-115.18.1.el7a.ppc64le.rpm kernel-debuginfo-common-ppc64le-4.14.0-115.18.1.el7a.ppc64le.rpm kernel-devel-4.14.0-115.18.1.el7a.ppc64le.rpm kernel-headers-4.14.0-115.18.1.el7a.ppc64le.rpm kernel-tools-4.14.0-115.18.1.el7a.ppc64le.rpm kernel-tools-debuginfo-4.14.0-115.18.1.el7a.ppc64le.rpm kernel-tools-libs-4.14.0-115.18.1.el7a.ppc64le.rpm perf-4.14.0-115.18.1.el7a.ppc64le.rpm perf-debuginfo-4.14.0-115.18.1.el7a.ppc64le.rpm python-perf-4.14.0-115.18.1.el7a.ppc64le.rpm python-perf-debuginfo-4.14.0-115.18.1.el7a.ppc64le.rpm
s390x: kernel-4.14.0-115.18.1.el7a.s390x.rpm kernel-debug-4.14.0-115.18.1.el7a.s390x.rpm kernel-debug-debuginfo-4.14.0-115.18.1.el7a.s390x.rpm kernel-debug-devel-4.14.0-115.18.1.el7a.s390x.rpm kernel-debuginfo-4.14.0-115.18.1.el7a.s390x.rpm kernel-debuginfo-common-s390x-4.14.0-115.18.1.el7a.s390x.rpm kernel-devel-4.14.0-115.18.1.el7a.s390x.rpm kernel-headers-4.14.0-115.18.1.el7a.s390x.rpm kernel-kdump-4.14.0-115.18.1.el7a.s390x.rpm kernel-kdump-debuginfo-4.14.0-115.18.1.el7a.s390x.rpm kernel-kdump-devel-4.14.0-115.18.1.el7a.s390x.rpm perf-4.14.0-115.18.1.el7a.s390x.rpm perf-debuginfo-4.14.0-115.18.1.el7a.s390x.rpm python-perf-4.14.0-115.18.1.el7a.s390x.rpm python-perf-debuginfo-4.14.0-115.18.1.el7a.s390x.rpm
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7):
aarch64: kernel-debug-debuginfo-4.14.0-115.18.1.el7a.aarch64.rpm kernel-debuginfo-4.14.0-115.18.1.el7a.aarch64.rpm kernel-debuginfo-common-aarch64-4.14.0-115.18.1.el7a.aarch64.rpm kernel-tools-debuginfo-4.14.0-115.18.1.el7a.aarch64.rpm kernel-tools-libs-devel-4.14.0-115.18.1.el7a.aarch64.rpm perf-debuginfo-4.14.0-115.18.1.el7a.aarch64.rpm python-perf-debuginfo-4.14.0-115.18.1.el7a.aarch64.rpm
noarch: kernel-doc-4.14.0-115.18.1.el7a.noarch.rpm
ppc64le: kernel-debug-debuginfo-4.14.0-115.18.1.el7a.ppc64le.rpm kernel-debug-devel-4.14.0-115.18.1.el7a.ppc64le.rpm kernel-debuginfo-4.14.0-115.18.1.el7a.ppc64le.rpm kernel-debuginfo-common-ppc64le-4.14.0-115.18.1.el7a.ppc64le.rpm kernel-tools-debuginfo-4.14.0-115.18.1.el7a.ppc64le.rpm kernel-tools-libs-devel-4.14.0-115.18.1.el7a.ppc64le.rpm perf-debuginfo-4.14.0-115.18.1.el7a.ppc64le.rpm python-perf-debuginfo-4.14.0-115.18.1.el7a.ppc64le.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/

Severity

Advisory ID: RHSA-2020:0740-01

Product: Red Hat Enterprise Linux

Advisory URL: https://access.redhat.com/errata/RHSA-2020:0740

Issued Date: : 2020-03-09

CVE Names: CVE-2018-16871 CVE-2019-3459 CVE-2019-3460 CVE-2019-11884 CVE-2019-15030 CVE-2019-15916 CVE-2019-17666 CVE-2019-18805

Topic

An update for kernel-alt is now available for Red Hat Enterprise Linux 7.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.

Topic

Relevant Releases Architectures

Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) - aarch64, noarch, ppc64le, s390x

Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) - aarch64, noarch, ppc64le

Bugs Fixed

1655162 - CVE-2018-16871 kernel: nfs: NULL pointer dereference due to an anomalized NFS message sequence

1663176 - CVE-2019-3459 kernel: Heap address information leak while using L2CAP_GET_CONF_OPT

1663179 - CVE-2019-3460 kernel: Heap address information leak while using L2CAP_PARSE_CONF_RSP

1709837 - CVE-2019-11884 kernel: sensitive information disclosure from kernel stack memory via HIDPCONNADD command

1750813 - CVE-2019-15916 kernel: memory leak in register_queue_kobjects() in net/core/net-sysfs.c leads to denial of service

1759313 - CVE-2019-15030 kernel: powerpc: local user can read vector registers of other users' processes via a Facility Unavailable exception

1763690 - CVE-2019-17666 kernel: rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel lacks a certain upper-bound check, leading to a buffer overflow

1771496 - CVE-2019-18805 kernel: integer overflow in tcp_ack_update_rtt in net/ipv4/tcp_input.c

Get the Latest News & Insights