Red Hat Enterprise Linux 7 update for kernel-rt
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 6 |
| CVE-ID | CVE-2020-8648 CVE-2020-12362 CVE-2020-12363 CVE-2020-12364 CVE-2020-27170 CVE-2021-3347 |
| CWE-ID | CWE-416 CWE-190 CWE-20 CWE-476 CWE-203 |
| Exploitation vector | Local |
| Public exploit | N/A |
| Vulnerable software Subscribe |
kernel-rt (Red Hat package) Operating systems & Components / Operating system package or component Red Hat Enterprise Linux for Real Time Operating systems & Components / Operating system Red Hat Enterprise Linux for Real Time for NFV Operating systems & Components / Operating system |
| Vendor | Red Hat Inc. |
Security Bulletin
This security bulletin contains information about 6 vulnerabilities.
1) Use-after-free
EUVDB-ID: #VU28416
Risk: Low
CVSSv3.1:
CVE-ID: CVE-2020-8648
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a local authenticated user to #BASIC_IMPACT#.
There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the n_tty_receive_buf_common function in drivers/tty/n_tty.c.
MitigationInstall updates from vendor's website.
kernel-rt (Red Hat package): 3.10.0-229.1.2.rt56.141.2.el7_1 - 3.10.0-1160.24.1.rt56.1161.el7
Red Hat Enterprise Linux for Real Time: 7 - 7
Red Hat Enterprise Linux for Real Time for NFV: 7 - 7
CPE2.3 External linkshttp://access.redhat.com/errata/RHSA-2021:2316
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
2) Integer overflow
EUVDB-ID: #VU54234
Risk: Low
CVSSv3.1:
CVE-ID: CVE-2020-12362
CWE-ID:
CWE-190 - Integer overflow
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to integer overflow. A local user can run a specially crafted program to trigger integer overflow and execute arbitrary code with elevated privileges.
Install updates from vendor's website.
kernel-rt (Red Hat package): 3.10.0-229.1.2.rt56.141.2.el7_1 - 3.10.0-1160.24.1.rt56.1161.el7
Red Hat Enterprise Linux for Real Time: 7 - 7
Red Hat Enterprise Linux for Real Time for NFV: 7 - 7
CPE2.3 External linkshttp://access.redhat.com/errata/RHSA-2021:2316
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
3) Input validation error
EUVDB-ID: #VU54248
Risk: Low
CVSSv3.1:
CVE-ID: CVE-2020-12363
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input. A local user can run a specially crafted program to perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
kernel-rt (Red Hat package): 3.10.0-229.1.2.rt56.141.2.el7_1 - 3.10.0-1160.24.1.rt56.1161.el7
Red Hat Enterprise Linux for Real Time: 7 - 7
Red Hat Enterprise Linux for Real Time for NFV: 7 - 7
CPE2.3 External linkshttp://access.redhat.com/errata/RHSA-2021:2316
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
4) NULL pointer dereference
EUVDB-ID: #VU54249
Risk: Low
CVSSv3.1:
CVE-ID: CVE-2020-12364
CWE-ID:
CWE-476 - NULL Pointer Dereference
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error. A local user can run a specially crafted program to perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
kernel-rt (Red Hat package): 3.10.0-229.1.2.rt56.141.2.el7_1 - 3.10.0-1160.24.1.rt56.1161.el7
Red Hat Enterprise Linux for Real Time: 7 - 7
Red Hat Enterprise Linux for Real Time for NFV: 7 - 7
CPE2.3 External linkshttp://access.redhat.com/errata/RHSA-2021:2316
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
5) Observable discrepancy
EUVDB-ID: #VU51774
Risk: Low
CVSSv3.1:
CVE-ID: CVE-2020-27170
CWE-ID:
CWE-203 - Observable discrepancy
Exploit availability: No
DescriptionThe vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists in kernel/bpf/verifier.c due to kernel performs undesirable out-of-bounds speculation on
pointer arithmetic, leading to side-channel attacks that defeat Spectre
mitigations. A local user can run a specially crafted program to gain access to sensitive information.
Install updates from vendor's website.
kernel-rt (Red Hat package): 3.10.0-229.1.2.rt56.141.2.el7_1 - 3.10.0-1160.24.1.rt56.1161.el7
Red Hat Enterprise Linux for Real Time: 7 - 7
Red Hat Enterprise Linux for Real Time for NFV: 7 - 7
CPE2.3 External linkshttp://access.redhat.com/errata/RHSA-2021:2316
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
6) Use-after-free
EUVDB-ID: #VU52035
Risk: Low
CVSSv3.1:
CVE-ID: CVE-2021-3347
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a local user to elevate privileges on the system.
The vulnerability exists due to a use-after-free error when handling PI futexes. A local user can run a specially crafted program to trigger a use-after-free error and execute arbitrary code with elevated privileges.
Install updates from vendor's website.
kernel-rt (Red Hat package): 3.10.0-229.1.2.rt56.141.2.el7_1 - 3.10.0-1160.24.1.rt56.1161.el7
Red Hat Enterprise Linux for Real Time: 7 - 7
Red Hat Enterprise Linux for Real Time for NFV: 7 - 7
CPE2.3 External linkshttp://access.redhat.com/errata/RHSA-2021:2316
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
