SB2020101920 - Red Hat Enterprise Linux 7 update for kernel-alt
Published: October 19, 2020 Updated: April 24, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Input validation error (CVE-ID: CVE-2020-12351)
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to insufficient validation of user-supplied input within the BlueZ implementation in Linux kernel. A remote attacker on the local network can pass specially crafted input to the application and execute arbitrary code on the system.
2) Improper access control (CVE-ID: CVE-2020-12352)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to improper access restrictions in BlueZ implementation in Linux kernel. A remote attacker on the local network can pass specially crafted input to the application and gain access to sensitive information.
3) Use of insufficiently random values (CVE-ID: CVE-2020-16166)
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
The vulnerability exists due to use of insufficiently random values error within the prandom_state_selftest() function in lib/random32.c, within the update_process_times() function in kernel/time/timer.c, within the add_interrupt_randomness() function in drivers/char/random.c. A remote non-authenticated attacker can gain access to sensitive information.
4) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2020-25212)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a TOCTOU mismatch in the NFS client code in the Linux kernel. A local user can run a specially crafted program to trigger memory corruption and execute arbitrary code on the system with elevated privileges.Remediation
Install update from vendor's website.