Synopsis:          Important: kernel security, bug fix, and enhancement 
Advisory ID:       SLSA-2018:3083-1
Issue Date:        2018-10-30
CVE Numbers:       CVE-2015-8830
                   CVE-2018-5803
                   CVE-2018-1130
                   CVE-2017-0861
                   CVE-2018-5391
                   CVE-2016-4913
                   CVE-2017-10661
                   CVE-2017-17805
                   CVE-2018-5344
                   CVE-2018-1000026
                   CVE-2017-18208
                   CVE-2018-7740
                   CVE-2018-7757
                   CVE-2017-18232
                   CVE-2018-1092
                   CVE-2018-1094
                   CVE-2018-8781
                   CVE-2018-10322
                   CVE-2018-1118
                   CVE-2018-1120
                   CVE-2018-10940
                   CVE-2018-10902
                   CVE-2018-5848
                   CVE-2018-10878
                   CVE-2018-10879
                   CVE-2018-10881
                   CVE-2018-10883
                   CVE-2018-13405
                   CVE-2017-18344
--

Security Fix(es):

* A flaw named FragmentSmack was found in the way the Linux kernel handled
reassembly of fragmented IPv4 and IPv6 packets. A remote attacker could
use this flaw to trigger time and calculation expensive fragment
reassembly algorithm by sending specially crafted packets which could lead
to a CPU saturation and hence a denial of service on the system.
(CVE-2018-5391)

* kernel: out-of-bounds access in the show_timer function in kernel/time
/posix-timers.c (CVE-2017-18344)

* kernel: Integer overflow in udl_fb_mmap() can allow attackers to execute
code in kernel space (CVE-2018-8781)

* kernel: MIDI driver race condition leads to a double-free
(CVE-2018-10902)

* kernel: Missing check in inode_init_owner() does not clear SGID bit on
non-directories for non-members (CVE-2018-13405)

* kernel: AIO write triggers integer overflow in some protocols
(CVE-2015-8830)

* kernel: Use-after-free in snd_pcm_info function in ALSA subsystem
potentially leads to privilege escalation (CVE-2017-0861)

* kernel: Handling of might_cancel queueing is not properly pretected
against race (CVE-2017-10661)

* kernel: Salsa20 encryption algorithm does not correctly handle zero-
length inputs allowing local attackers to cause denial of service
(CVE-2017-17805)

* kernel: Inifinite loop vulnerability in madvise_willneed() function
allows local denial of service (CVE-2017-18208)

* kernel: fuse-backed file mmap-ed onto process cmdline arguments causes
denial of service (CVE-2018-1120)

* kernel: a null pointer dereference in dccp_write_xmit() leads to a
system crash (CVE-2018-1130)

* kernel: drivers/block/loop.c mishandles lo_release serialization
allowing denial of service (CVE-2018-5344)

* kernel: Missing length check of payload in _sctp_make_chunk() function
allows denial of service (CVE-2018-5803)

* kernel: buffer overflow in
drivers/net/wireless/ath/wil6210/wmi.c:wmi_set_ie() may lead to memory
corruption (CVE-2018-5848)

* kernel: out-of-bound write in ext4_init_block_bitmap function with a
crafted ext4 image (CVE-2018-10878)

* kernel: Improper validation in bnx2x network card driver can allow for
denial of service attacks via crafted packet (CVE-2018-1000026)

* kernel: Information leak when handling NM entries containing NUL
(CVE-2016-4913)

* kernel: Mishandling mutex within libsas allowing local Denial of Service
(CVE-2017-18232)

* kernel: NULL pointer dereference in ext4_process_freed_data() when
mounting crafted ext4 image (CVE-2018-1092)

* kernel: NULL pointer dereference in ext4_xattr_inode_hash() causes crash
with crafted ext4 image (CVE-2018-1094)

* kernel: vhost: Information disclosure in vhost/vhost.c:vhost_new_msg()
(CVE-2018-1118)

* kernel: Denial of service in resv_map_release function in mm/hugetlb.c
(CVE-2018-7740)

* kernel: Memory leak in the sas_smp_get_phy_events function in
drivers/scsi/libsas/sas_expander.c (CVE-2018-7757)

* kernel: Invalid pointer dereference in xfs_ilock_attr_map_shared() when
mounting crafted xfs image allowing denial of service (CVE-2018-10322)

* kernel: use-after-free detected in ext4_xattr_set_entry with a crafted
file (CVE-2018-10879)

* kernel: out-of-bound access in ext4_get_group_info() when mounting and
operating a crafted ext4 image (CVE-2018-10881)

* kernel: stack-out-of-bounds write in jbd2_journal_dirty_metadata
function (CVE-2018-10883)

* kernel: incorrect memory bounds check in drivers/cdrom/cdrom.c
(CVE-2018-10940)
--

SL7
  x86_64
    bpftool-3.10.0-957.el7.x86_64.rpm
    kernel-3.10.0-957.el7.x86_64.rpm
    kernel-debug-3.10.0-957.el7.x86_64.rpm
    kernel-debug-debuginfo-3.10.0-957.el7.x86_64.rpm
    kernel-debug-devel-3.10.0-957.el7.x86_64.rpm
    kernel-debuginfo-3.10.0-957.el7.x86_64.rpm
    kernel-debuginfo-common-x86_64-3.10.0-957.el7.x86_64.rpm
    kernel-devel-3.10.0-957.el7.x86_64.rpm
    kernel-headers-3.10.0-957.el7.x86_64.rpm
    kernel-tools-3.10.0-957.el7.x86_64.rpm
    kernel-tools-debuginfo-3.10.0-957.el7.x86_64.rpm
    kernel-tools-libs-3.10.0-957.el7.x86_64.rpm
    perf-3.10.0-957.el7.x86_64.rpm
    perf-debuginfo-3.10.0-957.el7.x86_64.rpm
    python-perf-3.10.0-957.el7.x86_64.rpm
    python-perf-debuginfo-3.10.0-957.el7.x86_64.rpm
    kernel-tools-libs-devel-3.10.0-957.el7.x86_64.rpm
  noarch
    kernel-abi-whitelists-3.10.0-957.el7.noarch.rpm
    kernel-doc-3.10.0-957.el7.noarch.rpm

- Scientific Linux Development Team