Red Hat update for kernel



Published: 2016-05-03
Risk Low
Patch available YES
Number of vulnerabilities 2
CVE-ID CVE-2015-5157
CVE-2015-8767
CWE-ID CWE-264
CWE-362
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe
Red Hat Enterprise Linux Server - Extended Update Support from RHUI
Operating systems & Components / Operating system

Red Hat Enterprise Linux Server from RHUI
Operating systems & Components / Operating system

Red Hat Enterprise Linux for Power, big endian - Extended Update Support
Operating systems & Components / Operating system

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Operating systems & Components / Operating system

Red Hat Enterprise Linux Server - Extended Update Support
Operating systems & Components / Operating system

Red Hat Enterprise Linux for Power, big endian
Operating systems & Components / Operating system

Red Hat Enterprise Linux for Scientific Computing
Operating systems & Components / Operating system

Red Hat Enterprise Linux for IBM z Systems
Operating systems & Components / Operating system

Red Hat Enterprise Linux EUS Compute Node
Operating systems & Components / Operating system

Red Hat Enterprise Linux Desktop
Operating systems & Components / Operating system

Red Hat Enterprise Linux Workstation
Operating systems & Components / Operating system

Red Hat Enterprise Linux Server
Operating systems & Components / Operating system

kernel (Red Hat package)
Operating systems & Components / Operating system package or component

Vendor Red Hat Inc.

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Privilege escalation

EUVDB-ID: #VU2590

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2015-5157

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists in arch/x86/entry/entry_64.S on the x86_64 platform due to mishandling of IRET faults in processing NMIs that occurred during userspace execution. A local attacker can trigger NMI and bypass security restrictions.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux Server - Extended Update Support from RHUI: 6.7

Red Hat Enterprise Linux Server from RHUI: 6.0

Red Hat Enterprise Linux for Power, big endian - Extended Update Support: 6.7

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support: 6.7

Red Hat Enterprise Linux Server - Extended Update Support: 6.7

kernel (Red Hat package): 2.6.32-71.7.1.el6 - 2.6.32-573.22.1.el6

Red Hat Enterprise Linux for Power, big endian: 6

Red Hat Enterprise Linux for Scientific Computing: 6

Red Hat Enterprise Linux for IBM z Systems: 6

Red Hat Enterprise Linux EUS Compute Node: 6.7

Red Hat Enterprise Linux Desktop: 6

Red Hat Enterprise Linux Workstation: 6

Red Hat Enterprise Linux Server: 6.0

:


CPE2.3 External links

http://access.redhat.com/errata/RHSA-2016:0715

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

2) Race condition

EUVDB-ID: #VU3882

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2015-8767

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a local attacker to cause DoS condition on the target system.

The weakness exists in net/sctp/sm_sideeffect.c due to improper management of the relationship between a lock and a socket. A local attacker can submit a specially crafted sctp_accept call, trigger race condition and cause the service to crash.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux Server - Extended Update Support from RHUI: 6.7

Red Hat Enterprise Linux Server from RHUI: 6.0

Red Hat Enterprise Linux for Power, big endian - Extended Update Support: 6.7

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support: 6.7

Red Hat Enterprise Linux Server - Extended Update Support: 6.7

kernel (Red Hat package): 2.6.32-71.7.1.el6 - 2.6.32-573.22.1.el6

Red Hat Enterprise Linux for Power, big endian: 6

Red Hat Enterprise Linux for Scientific Computing: 6

Red Hat Enterprise Linux for IBM z Systems: 6

Red Hat Enterprise Linux EUS Compute Node: 6.7

Red Hat Enterprise Linux Desktop: 6

Red Hat Enterprise Linux Workstation: 6

Red Hat Enterprise Linux Server: 6.0

:


CPE2.3 External links

http://access.redhat.com/errata/RHSA-2016:0715

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?



###SIDEBAR###