SB2020042877 - Red Hat Enterprise Linux 8 update for kernel-rt
Published: April 28, 2020
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 16 secuirty vulnerabilities.
1) NULL pointer dereference (CVE-ID: CVE-2018-16871)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error in the Network File System (NFS) implementation. A remote authenticated attacker can mount an exported NFS filesystem, cause a NULL pointer dereference condition due to an invalid NFS sequence and perform a denial of service (DoS) attack.
2) Information disclosure (CVE-ID: CVE-2019-10639)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to the possibility to extract the Kernel Address Space Layout Randomization (KASLR) kernel image offset of the affected software using the IP ID values that the kernel produces for connectionless protocols. A remote attacker can force the targeted system to send UDP or ICMP traffic to an attacker-controlled IP address and gain unauthorized access to sensitive information on the system.
3) Out-of-bounds read (CVE-ID: CVE-2019-15090)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists in the QLogic QEDI iSCSI Initiator Driver due to a boundary condition in "drivers/scsi/qedi/qedi_dbg.c". A local authenticated user can trigger out-of-bounds read error and read contents of memory on the system.
4) NULL pointer dereference (CVE-ID: CVE-2019-15099)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error in the "drivers/net/wireless/ath/ath10k/usb.c". A remote attacker can trigger denial of service conditions via an incomplete address in an endpoint descriptor.
5) NULL pointer dereference (CVE-ID: CVE-2019-15221)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error in sound/usb/line6/pcm.c driver. A local user can perform a denial of service (DoS) attack using a malicious USB device.
6) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2019-17053)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to the ieee802154_create() function in net/ieee802154/socket.c in the AF_IEEE802154 network module for the Linux kernel does not enforce CAP_NET_RAW when creating raw sockets. A local unprivileged user can create raw sockets on the system.
7) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2019-17055)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to the base_sock_create in drivers/isdn/mISDN/socket.c in the AF_ISDN network module for the Linux kernel does not enforce CAP_NET_RAW. A local unprivileged user can create a raw socket.
8) Integer overflow (CVE-ID: CVE-2019-18805)
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
An issue was discovered in net/ipv4/sysctl_net_ipv4.c in the Linux kernel before 5.0.11. There is a net/ipv4/tcp_input.c signed integer overflow in tcp_ack_update_rtt() when userspace writes a very large integer to /proc/sys/net/ipv4/tcp_min_rtt_wlen, leading to a denial of service or possibly unspecified other impact, aka CID-19fad20d15a6.
9) Memory leak (CVE-ID: CVE-2019-19057)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to memory leak within the "mwifiex_pcie_init_evt_ring()" function in "drivers/net/wireless/marvell/mwifiex/pcie.c" file. A remote attacker on the local network can cause a denial of service condition (memory consumption) by triggering "mwifiex_map_pci_memory()" failures.
10) Memory leak (CVE-ID: CVE-2019-19073)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to memory leak within the "htc_config_pipe_credits()", "htc_setup_complete()" and "htc_connect_service()" functions in "drivers/net/wireless/ath/ath9k/htc_hst.c" file. A remote attacker on the local network can cause a denial of service condition (memory consumption) by triggering "wait_for_completion_timeout()" failures.11) Memory leak (CVE-ID: CVE-2019-19074)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to memory leak within the "ath9k_wmi_cmd()" function in "drivers/net/wireless/ath/ath9k/wmi.c" file. A remote attacker on the local network can cause a denial of service condition (memory consumption).
12) Information disclosure (CVE-ID: CVE-2019-19534)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output within the USB driver in drivers/net/can/usb/peak_usb/pcan_usb_core.c driver. A local use can use a specially crafted USB devices to gain unauthorized access to sensitive information on the system.
13) Use-after-free (CVE-ID: CVE-2019-19768)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error in the __blk_add_trace() function in kernel/trace/blktrace.c. A local user can run a specially crafted program, trigger a use-after-free error and execute arbitrary code on the system with elevated privileges.
14) Memory leak (CVE-ID: CVE-2019-19922)
The vulnerability allows a local user to perform DoS attack on the target system.
The vulnerability exists due memory leak in "kernel/sched/fair.c" when "cpu.cfs_quota_us" is used (e.g., with Kubernetes). A local user can cause a denial of service against non-cpu-bound applications by generating a workload that triggers unwanted slice expiration.
15) Memory leak (CVE-ID: CVE-2019-8980)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper memory operations in the kernel_read_file function, as defined in the fs/exec.c source code file. A remote attacker can send malicious file that triggers vfs_read failures and memory leak condition and perform a denial of service attack.
16) Cleartext transmission of sensitive information (CVE-ID: CVE-2020-1749)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to incorrect implementation of some networking protocols in IPsec, such as VXLAN and GENEVE tunnels over IPv6. When an encrypted tunnel is created between two hosts, the kernel isn't correctly routing tunneled data over the encrypted link; rather sending the data unencrypted. This would allow anyone in between the two endpoints to read the traffic unencrypted.
Remediation
Install update from vendor's website.