Red Hat update for kernel

1) Privilege escalation

EUVDB-ID: #VU7206

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-7518

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows an local attacker to gain elevated privileges on the guest system.

The weakness exists due to debug exception error in syscall emulation. A attacker can gain system privileges.

Successful exploitation of the vulnerability results in privilege escalation.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux Server - 4 Year Extended Update Support: 7.4

Red Hat Enterprise Linux Server (for IBM Power LE) - 4 Year Extended Update Support: 7.4

Red Hat Enterprise Linux Server - TUS: 7.4

Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 7.4

Red Hat Enterprise Linux for Power, big endian - Extended Update Support: 7.4

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support: 7.4

Red Hat Enterprise Linux Server - AUS: 7.4

Red Hat Enterprise Linux Server - Extended Update Support: 7.4

kernel (Red Hat package): 3.10.0-123.1.2.el7 - 3.10.0-693.17.1.el7

Red Hat Enterprise Linux for Power, little endian: 7

Red Hat Enterprise Linux for Power, big endian: 7

Red Hat Virtualization Host: 4

Red Hat Enterprise Linux EUS Compute Node: 7.4

Red Hat Enterprise Linux for IBM z Systems: 7

Red Hat Enterprise Linux for Scientific Computing: 7

Red Hat Enterprise Linux Desktop: 7

Red Hat Enterprise Linux Workstation: 7

Red Hat Enterprise Linux Server: 7

:

External links

http://access.redhat.com/errata/RHSA-2018:0395

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Path traversal

EUVDB-ID: #VU12296

Risk: High

CVSSv3.1: 8.3 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-12188

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows an adjacent attacker to cause DoS condition or execute arbitrary code on the target system.

The weakness exists in arch/x86/kvm/mmu.c due to improper traversal of guest pagetable entries to resolve a guest virtual address when nested virtualisation is used. An adjacent attacker can cause the service to crash or execute arbitrary code.

Successful exploitation of the vulnerability may result in system compromise.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux Server - 4 Year Extended Update Support: 7.4

Red Hat Enterprise Linux Server (for IBM Power LE) - 4 Year Extended Update Support: 7.4

Red Hat Enterprise Linux Server - TUS: 7.4

Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 7.4

Red Hat Enterprise Linux for Power, big endian - Extended Update Support: 7.4

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support: 7.4

Red Hat Enterprise Linux Server - AUS: 7.4

Red Hat Enterprise Linux Server - Extended Update Support: 7.4

kernel (Red Hat package): 3.10.0-123.1.2.el7 - 3.10.0-693.17.1.el7

Red Hat Enterprise Linux for Power, little endian: 7

Red Hat Enterprise Linux for Power, big endian: 7

Red Hat Virtualization Host: 4

Red Hat Enterprise Linux EUS Compute Node: 7.4

Red Hat Enterprise Linux for IBM z Systems: 7

Red Hat Enterprise Linux for Scientific Computing: 7

Red Hat Enterprise Linux Desktop: 7

Red Hat Enterprise Linux Workstation: 7

Red Hat Enterprise Linux Server: 7

:

External links

http://access.redhat.com/errata/RHSA-2018:0395

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.