Red Hat update for kernel

1) Improper privilege management

EUVDB-ID: #VU8696

Risk: Low

CVSSv3.1: 5.9 [CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-12154

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The prepare_vmcs02 function in arch/x86/kvm/vmx.c in the Linux kernel through 4.13.3 does not ensure that the "CR8-load exiting" and "CR8-store exiting" L0 vmcs02 controls exist in cases where L1 omits the "use TPR shadow" vmcs12 control, which allows KVM L2 guest OS users to obtain read and write access to the hardware CR8 register.

Install updates from vendor's website.

Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions: 7.4

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions: 7.4

Red Hat Enterprise Linux Server - TUS: 7.4

Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 7.4

Red Hat Enterprise Linux for Power, big endian - Extended Update Support: 7.4

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support: 7.4

Red Hat Enterprise Linux Server - AUS: 7.4

Red Hat Enterprise Linux Server - Extended Update Support: 7.4

kernel (Red Hat package): 3.10.0-123.1.2.el7 - 3.10.0-693.50.3.el7

Red Hat Enterprise Linux EUS Compute Node: 7.4

:

http://access.redhat.com/errata/RHSA-2019:1946

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Memory corruption

EUVDB-ID: #VU10680

Risk: Low

CVSSv3.1: 6.2 [CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-15129

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local unprivileged attacker to cause DoS condition no the target system.

The weakness exists due to the function get_net_ns_by_id() in net/core/net_namespace.c does not check for the net::count value after it has found a peer network in netns_ids idr. A local attacker can induce kernel memory corruption, trigger use-after-free and double free error in network namespaces code to cause the system to crash.

Install updates from vendor's website.

Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions: 7.4

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions: 7.4

Red Hat Enterprise Linux Server - TUS: 7.4

Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 7.4

Red Hat Enterprise Linux for Power, big endian - Extended Update Support: 7.4

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support: 7.4

Red Hat Enterprise Linux Server - AUS: 7.4

Red Hat Enterprise Linux Server - Extended Update Support: 7.4

kernel (Red Hat package): 3.10.0-123.1.2.el7 - 3.10.0-693.50.3.el7

Red Hat Enterprise Linux EUS Compute Node: 7.4

:

http://access.redhat.com/errata/RHSA-2019:1946

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) NULL pointer dereference

EUVDB-ID: #VU10721

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-15274

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local attacker to cause DoS condition on the target system.

The weakness exists in he security/keys/keyctl.c due to a NULL pointer dereference. A local attacker can create a specially crafted add_key or keyctl system call and cause a denial of service.

Install updates from vendor's website.

Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions: 7.4

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions: 7.4

Red Hat Enterprise Linux Server - TUS: 7.4

Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 7.4

Red Hat Enterprise Linux for Power, big endian - Extended Update Support: 7.4

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support: 7.4

Red Hat Enterprise Linux Server - AUS: 7.4

Red Hat Enterprise Linux Server - Extended Update Support: 7.4

kernel (Red Hat package): 3.10.0-123.1.2.el7 - 3.10.0-693.50.3.el7

Red Hat Enterprise Linux EUS Compute Node: 7.4

:

http://access.redhat.com/errata/RHSA-2019:1946

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Information disclosure

EUVDB-ID: #VU13850

Risk: Low

CVSSv3.1: 3 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C]

CVE-ID: CVE-2018-3693

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local attacker to obtain potentially sensitive information.

The vulnerability exists in the design of most modern CPUs using speculative execution and branch prediction due to improper speculative execution of instructions. A local attacker can bypass bounds checks, trigger buffer overflow, perform arbitrary speculative execution and a side-channel attack to access sensitive memory information.

Install updates from vendor's website.

Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions: 7.4

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions: 7.4

Red Hat Enterprise Linux Server - TUS: 7.4

Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 7.4

Red Hat Enterprise Linux for Power, big endian - Extended Update Support: 7.4

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support: 7.4

Red Hat Enterprise Linux Server - AUS: 7.4

Red Hat Enterprise Linux Server - Extended Update Support: 7.4

kernel (Red Hat package): 3.10.0-123.1.2.el7 - 3.10.0-693.50.3.el7

Red Hat Enterprise Linux EUS Compute Node: 7.4

:

http://access.redhat.com/errata/RHSA-2019:1946

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

5) Stack-based buffer overflow

EUVDB-ID: #VU14920

Risk: Medium

CVSSv3.1: 7.1 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-14633

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Install updates from vendor's website.

Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions: 7.4

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions: 7.4

Red Hat Enterprise Linux Server - TUS: 7.4

Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 7.4

Red Hat Enterprise Linux for Power, big endian - Extended Update Support: 7.4

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support: 7.4

Red Hat Enterprise Linux Server - AUS: 7.4

Red Hat Enterprise Linux Server - Extended Update Support: 7.4

kernel (Red Hat package): 3.10.0-123.1.2.el7 - 3.10.0-693.50.3.el7

Red Hat Enterprise Linux EUS Compute Node: 7.4

:

http://access.redhat.com/errata/RHSA-2019:1946

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.