Red Hat Enterprise Linux 8.1 Extended Update Support update for kpatch-patch

Published: 2020-08-04

Risk	Low
Patch available	YES
Number of vulnerabilities	3
CVE-ID	CVE-2020-10766 CVE-2020-10767 CVE-2020-10768
CWE-ID	CWE-362 CWE-399 CWE-20
Exploitation vector	Local
Public exploit	N/A
Vulnerable software Subscribe	Red Hat Enterprise Linux for x86_64 - Extended Update Support Operating systems & Components / Operating system kpatch-patch-4_18_0-147_8_1 (Red Hat package) Operating systems & Components / Operating system package or component kpatch-patch-4_18_0-147_5_1 (Red Hat package) Operating systems & Components / Operating system package or component kpatch-patch-4_18_0-147_3_1 (Red Hat package) Operating systems & Components / Operating system package or component kpatch-patch-4_18_0-147_20_1 (Red Hat package) Operating systems & Components / Operating system package or component kpatch-patch-4_18_0-147_13_2 (Red Hat package) Operating systems & Components / Operating system package or component kpatch-patch-4_18_0-147_0_3 (Red Hat package) Operating systems & Components / Operating system package or component kpatch-patch-4_18_0-147_0_2 (Red Hat package) Operating systems & Components / Operating system package or component kpatch-patch-4_18_0-147 (Red Hat package) Operating systems & Components / Operating system package or component
Vendor	Red Hat Inc.

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Race condition

EUVDB-ID: #VU47074

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-10766

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a local user to gain access to sensitive information.

A logic bug flaw was found in Linux kernel before 5.8-rc1 in the implementation of SSBD. A bug in the logic handling allows an attacker with a local account to disable SSBD protection during a context switch when additional speculative execution mitigations are in place. This issue was introduced when the per task/process conditional STIPB switching was added on top of the existing SSBD switching.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for x86_64 - Extended Update Support: 8.1

kpatch-patch-4_18_0-147_8_1 (Red Hat package): before 1-5.el8_1

kpatch-patch-4_18_0-147_5_1 (Red Hat package): before 1-7.el8_1

kpatch-patch-4_18_0-147_3_1 (Red Hat package): before 1-12.el8_1

kpatch-patch-4_18_0-147_20_1 (Red Hat package): before 1-2.el8_1

kpatch-patch-4_18_0-147_13_2 (Red Hat package): before 1-3.el8_1

kpatch-patch-4_18_0-147_0_3 (Red Hat package): before 1-12.el8

kpatch-patch-4_18_0-147_0_2 (Red Hat package): before 1-12.el8

kpatch-patch-4_18_0-147 (Red Hat package): before 1-16.el8

CPE2.3

cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_x86_64_-_extended_update_support:8.1:*:*:*:*:red_hat_enterprise_linux:*:

External links

http://access.redhat.com/errata/RHSA-2020:3297

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Resource management error

EUVDB-ID: #VU47075

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-10767

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to gain access to sensitive information.

A flaw was found in the Linux kernel before 5.8-rc1 in the implementation of the Enhanced IBPB (Indirect Branch Prediction Barrier). The IBPB mitigation will be disabled when STIBP is not available or when the Enhanced Indirect Branch Restricted Speculation (IBRS) is available. This flaw allows a local user to perform a Spectre V2 style attack when this configuration is active.