Red Hat update for kernel

1) Speculative Store Bypass

EUVDB-ID: #VU12911

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-3639

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

The vulnerability allows a local attacker to obtain potentially sensitive information on the target system.

The weakness exists due to race conditions in CPU cache processing. A local attacker can conduct a side-channel attack to exploit a flaw in the speculative execution of Load and Store instructions to read privileged memory.

Note: the vulnerability is referred to as "Spectre variant 4".

Install updates from vendor's website.

Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems): 6.0

Red Hat Enterprise Linux Server - Extended Life Cycle Support: 6.0

kernel (Red Hat package): 2.6.32-71.7.1.el6 - 2.6.32-696.el6

Red Hat Enterprise Linux for Power, big endian: 6

Red Hat Enterprise Linux for Scientific Computing: 6

Red Hat Enterprise Linux for IBM z Systems: 6

Red Hat Enterprise Linux Desktop: 6

Red Hat Enterprise Linux Workstation: 6

Red Hat Enterprise Linux Server: 6.0

:

http://access.redhat.com/errata/RHSA-2018:2164

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Side-channel attack

EUVDB-ID: #VU13337

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-3665

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local attacker to obtain potentially sensitive information.

The vulnerability exists due to utilizing the Lazy FP state restore technique for floating point state when context switching between application processes. A local attacker can conduct cache side-channel attacks and determine register values of other processes.

Note: This vulnerability is known as LazyFP.

Install updates from vendor's website.

Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems): 6.0

Red Hat Enterprise Linux Server - Extended Life Cycle Support: 6.0

kernel (Red Hat package): 2.6.32-71.7.1.el6 - 2.6.32-696.el6

Red Hat Enterprise Linux for Power, big endian: 6

Red Hat Enterprise Linux for Scientific Computing: 6

Red Hat Enterprise Linux for IBM z Systems: 6

Red Hat Enterprise Linux Desktop: 6

Red Hat Enterprise Linux Workstation: 6

Red Hat Enterprise Linux Server: 6.0

:

http://access.redhat.com/errata/RHSA-2018:2164

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Use-after-free error

EUVDB-ID: #VU13023

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-10675

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Install updates from vendor's website.

Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems): 6.0

Red Hat Enterprise Linux Server - Extended Life Cycle Support: 6.0

kernel (Red Hat package): 2.6.32-71.7.1.el6 - 2.6.32-696.el6

Red Hat Enterprise Linux for Power, big endian: 6

Red Hat Enterprise Linux for Scientific Computing: 6

Red Hat Enterprise Linux for IBM z Systems: 6

Red Hat Enterprise Linux Desktop: 6

Red Hat Enterprise Linux Workstation: 6

Red Hat Enterprise Linux Server: 6.0

:

http://access.redhat.com/errata/RHSA-2018:2164

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Denial of service

EUVDB-ID: #VU13877

Risk: Low

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-10872

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to a flaw in the way the Linux kernel handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, processor does not deliver interrupts and exceptions, they are delivered once the first instruction after the stack switch is executed. A remote attacker can crash the system kernel resulting in DoS.

Install updates from vendor's website.

Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems): 6.0

Red Hat Enterprise Linux Server - Extended Life Cycle Support: 6.0

kernel (Red Hat package): 2.6.32-71.7.1.el6 - 2.6.32-696.el6

Red Hat Enterprise Linux for Power, big endian: 6

Red Hat Enterprise Linux for Scientific Computing: 6

Red Hat Enterprise Linux for IBM z Systems: 6

Red Hat Enterprise Linux Desktop: 6

Red Hat Enterprise Linux Workstation: 6

Red Hat Enterprise Linux Server: 6.0

:

http://access.redhat.com/errata/RHSA-2018:2164

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Privilege escalation

EUVDB-ID: #VU12450

Risk: Low

CVSSv3.1: 8.4 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C]

CVE-ID: CVE-2018-8897

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

Exploit availability: Yes

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The vulnerability exists due to improper implementation of Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) on multiple system kernels, which results in an unexpected behavior for #DB exceptions that are deferred by MOV SS or POP SS. A local user can execute arbitrary code with elevated privileges.

Install updates from vendor's website.

Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems): 6.0

Red Hat Enterprise Linux Server - Extended Life Cycle Support: 6.0

kernel (Red Hat package): 2.6.32-71.7.1.el6 - 2.6.32-696.el6

Red Hat Enterprise Linux for Power, big endian: 6

Red Hat Enterprise Linux for Scientific Computing: 6

Red Hat Enterprise Linux for IBM z Systems: 6

Red Hat Enterprise Linux Desktop: 6

Red Hat Enterprise Linux Workstation: 6

Red Hat Enterprise Linux Server: 6.0

:

http://access.redhat.com/errata/RHSA-2018:2164

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.