Red Hat Enterprise Linux 8.1 Extended Update Support update for kernel



| Updated: 2023-12-28
Risk High
Patch available YES
Number of vulnerabilities 11
CVE-ID CVE-2019-19807
CVE-2019-20908
CVE-2020-10713
CVE-2020-10757
CVE-2020-10766
CVE-2020-10767
CVE-2020-10768
CVE-2020-12653
CVE-2020-12654
CVE-2020-12888
CVE-2020-15780
CWE-ID CWE-416
CWE-276
CWE-787
CWE-269
CWE-362
CWE-399
CWE-20
CWE-264
CWE-285
Exploitation vector Network
Public exploit Public exploit code for vulnerability #3 is available.
Public exploit code for vulnerability #11 is available.
Vulnerable software
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support
Operating systems & Components / Operating system

Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
Operating systems & Components / Operating system

Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Operating systems & Components / Operating system

Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Operating systems & Components / Operating system

Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Operating systems & Components / Operating system

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Operating systems & Components / Operating system

Red Hat Enterprise Linux for x86_64 - Extended Update Support
Operating systems & Components / Operating system

kernel (Red Hat package)
Operating systems & Components / Operating system package or component

Vendor Red Hat Inc.

Security Bulletin

This security bulletin contains information about 11 vulnerabilities.

1) Use-after-free

EUVDB-ID: #VU30551

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-19807

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local authenticated user to execute arbitrary code.

In the Linux kernel before 5.3.11, sound/core/timer.c has a use-after-free caused by erroneous code refactoring, aka CID-e7af6307a8a5. This is related to snd_timer_open and snd_timer_close_locked. The timeri variable was originally intended to be for a newly created timer instance, but was used for a different purpose after refactoring.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support: 8.1

Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support: 8.1

Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support: 8.1

Red Hat Enterprise Linux for ARM 64 - Extended Update Support: 8.1

Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 8.1

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support: 8.1

Red Hat Enterprise Linux for x86_64 - Extended Update Support: 8.1

kernel (Red Hat package): before 4.18.0-147.24.2.el8_1

CPE2.3 External links

http://access.redhat.com/errata/RHSA-2020:3222


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Incorrect default permissions

EUVDB-ID: #VU34141

Risk: Low

CVSSv3.1: 5.8 [CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-20908

CWE-ID: CWE-276 - Incorrect Default Permissions

Exploit availability: No

Description

The vulnerability allows a local privileged user to execute arbitrary code.

An issue was discovered in drivers/firmware/efi/efi.c in the Linux kernel before 5.4. Incorrect access permissions for the efivar_ssdt ACPI variable could be used by attackers to bypass lockdown or secure boot restrictions, aka CID-1957a85b0032.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support: 8.1

Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support: 8.1

Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support: 8.1

Red Hat Enterprise Linux for ARM 64 - Extended Update Support: 8.1

Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 8.1

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support: 8.1

Red Hat Enterprise Linux for x86_64 - Extended Update Support: 8.1

kernel (Red Hat package): before 4.18.0-147.24.2.el8_1

CPE2.3 External links

http://access.redhat.com/errata/RHSA-2020:3222


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Out-of-bounds Write

EUVDB-ID: #VU32922

Risk: Low

CVSSv3.1: 6.1 [CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2020-10713

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: Yes

Description

The vulnerability allows a local attacker to compromise vulnerable system.

The vulnerability exists due to a "BootHole" issue. An attacker with physical access can install persistent and stealthy bootkits or malicious bootloaders, trigger out-of-bounds write and execute arbitrary code on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support: 8.1

Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support: 8.1

Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support: 8.1

Red Hat Enterprise Linux for ARM 64 - Extended Update Support: 8.1

Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 8.1

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support: 8.1

Red Hat Enterprise Linux for x86_64 - Extended Update Support: 8.1

kernel (Red Hat package): before 4.18.0-147.24.2.el8_1

CPE2.3 External links

http://access.redhat.com/errata/RHSA-2020:3222


Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

4) Improper Privilege Management

EUVDB-ID: #VU29957

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-10757

CWE-ID: CWE-269 - Improper Privilege Management

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists in the Linux Kernel in versions after 4.5-rc1 in the way mremap handled DAX Huge Pages. This flaw allows a local attacker with access to a DAX enabled storage to escalate their privileges on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support: 8.1

Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support: 8.1

Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support: 8.1

Red Hat Enterprise Linux for ARM 64 - Extended Update Support: 8.1

Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 8.1

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support: 8.1

Red Hat Enterprise Linux for x86_64 - Extended Update Support: 8.1

kernel (Red Hat package): before 4.18.0-147.24.2.el8_1

CPE2.3 External links

http://access.redhat.com/errata/RHSA-2020:3222


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Race condition

EUVDB-ID: #VU47074

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-10766

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a local user to gain access to sensitive information.

A logic bug flaw was found in Linux kernel before 5.8-rc1 in the implementation of SSBD. A bug in the logic handling allows an attacker with a local account to disable SSBD protection during a context switch when additional speculative execution mitigations are in place. This issue was introduced when the per task/process conditional STIPB switching was added on top of the existing SSBD switching.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support: 8.1

Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support: 8.1

Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support: 8.1

Red Hat Enterprise Linux for ARM 64 - Extended Update Support: 8.1

Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 8.1

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support: 8.1

Red Hat Enterprise Linux for x86_64 - Extended Update Support: 8.1

kernel (Red Hat package): before 4.18.0-147.24.2.el8_1

CPE2.3 External links

http://access.redhat.com/errata/RHSA-2020:3222


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Resource management error

EUVDB-ID: #VU47075

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-10767

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to gain access to sensitive information.

A flaw was found in the Linux kernel before 5.8-rc1 in the implementation of the Enhanced IBPB (Indirect Branch Prediction Barrier). The IBPB mitigation will be disabled when STIBP is not available or when the Enhanced Indirect Branch Restricted Speculation (IBRS) is available. This flaw allows a local user to perform a Spectre V2 style attack when this configuration is active.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support: 8.1

Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support: 8.1

Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support: 8.1

Red Hat Enterprise Linux for ARM 64 - Extended Update Support: 8.1

Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 8.1

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support: 8.1

Red Hat Enterprise Linux for x86_64 - Extended Update Support: 8.1

kernel (Red Hat package): before 4.18.0-147.24.2.el8_1

CPE2.3 External links

http://access.redhat.com/errata/RHSA-2020:3222


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Input validation error

EUVDB-ID: #VU47076

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-10768

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local authenticated user to gain access to sensitive information.

A flaw was found in the Linux Kernel before 5.8-rc1 in the prctl() function, where it can be used to enable indirect branch speculation after it has been disabled. This call incorrectly reports it as being 'force disabled' when it is not and opens the system to Spectre v2 attacks. The highest threat from this vulnerability is to confidentiality.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support: 8.1

Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support: 8.1

Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support: 8.1

Red Hat Enterprise Linux for ARM 64 - Extended Update Support: 8.1

Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 8.1

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support: 8.1

Red Hat Enterprise Linux for x86_64 - Extended Update Support: 8.1

kernel (Red Hat package): before 4.18.0-147.24.2.el8_1

CPE2.3 External links

http://access.redhat.com/errata/RHSA-2020:3222


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU28164

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-12653

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in the "mwifiex_cmd_append_vsie_tlv()" function in "drivers/net/wireless/marvell/mwifiex/scan.c" file. A local user can gain elevated privileges on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support: 8.1

Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support: 8.1

Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support: 8.1

Red Hat Enterprise Linux for ARM 64 - Extended Update Support: 8.1

Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 8.1

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support: 8.1

Red Hat Enterprise Linux for x86_64 - Extended Update Support: 8.1

kernel (Red Hat package): before 4.18.0-147.24.2.el8_1

CPE2.3 External links

http://access.redhat.com/errata/RHSA-2020:3222


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Out-of-bounds write

EUVDB-ID: #VU28162

Risk: High

CVSSv3.1: 8.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-12654

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input in the "mwifiex_ret_wmm_get_status()" function in "drivers/net/wireless/marvell/mwifiex/wmm.c" file. A remote attacker can trigger out-of-bounds write and execute arbitrary code on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support: 8.1

Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support: 8.1

Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support: 8.1

Red Hat Enterprise Linux for ARM 64 - Extended Update Support: 8.1

Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 8.1

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support: 8.1

Red Hat Enterprise Linux for x86_64 - Extended Update Support: 8.1

kernel (Red Hat package): before 4.18.0-147.24.2.el8_1

CPE2.3 External links

http://access.redhat.com/errata/RHSA-2020:3222


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Improper Handling of Exceptional Conditions

EUVDB-ID: #VU28159

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-12888

CWE-ID: N/A

Exploit availability: No

Description

The vulnerability allows a local user to perform a deinal of service (DoS) attack.

The vulnerability exists due to the VFIO PCI driver mishandles attempts to access disabled memory space. A local user can cause a denial of service condition on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support: 8.1

Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support: 8.1

Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support: 8.1

Red Hat Enterprise Linux for ARM 64 - Extended Update Support: 8.1

Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 8.1

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support: 8.1

Red Hat Enterprise Linux for x86_64 - Extended Update Support: 8.1

kernel (Red Hat package): before 4.18.0-147.24.2.el8_1

CPE2.3 External links

http://access.redhat.com/errata/RHSA-2020:3222


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Improper Authorization

EUVDB-ID: #VU31922

Risk: Low

CVSSv3.1: 6 [CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2020-15780

CWE-ID: CWE-285 - Improper Authorization

Exploit availability: Yes

Description

The vulnerability allows a local user to bypass authorization checks.

The vulnerability exists due to improper authorization in "in drivers/acpi/acpi_configfs.c". A local administrator can inject malicious ACPI tables via configfs to bypass lockdown and secure boot restrictions.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support: 8.1

Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support: 8.1

Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support: 8.1

Red Hat Enterprise Linux for ARM 64 - Extended Update Support: 8.1

Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 8.1

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support: 8.1

Red Hat Enterprise Linux for x86_64 - Extended Update Support: 8.1

kernel (Red Hat package): before 4.18.0-147.24.2.el8_1

CPE2.3 External links

http://access.redhat.com/errata/RHSA-2020:3222


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.



###SIDEBAR###