SB2018071030 - Red Hat update for kernel 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2018071030

SB2018071030 - Red Hat update for kernel

Published: July 10, 2018

Security Bulletin ID SB2018071030
Severity
Low
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 secuirty vulnerabilities.


1) Speculative Store Bypass (CVE-ID: CVE-2018-3639)

The vulnerability allows a local attacker to obtain potentially sensitive information on the target system.

The weakness exists due to race conditions in CPU cache processing. A local attacker can conduct a side-channel attack to exploit a flaw in the speculative execution of Load and Store instructions to read privileged memory.

Note: the vulnerability is referred to as "Spectre variant 4".

2) Side-channel attack (CVE-ID: CVE-2018-3665)

The vulnerability allows a local attacker to obtain potentially sensitive information.

The vulnerability exists due to utilizing the Lazy FP state restore technique for floating point state when context switching between application processes. A local attacker can conduct cache side-channel attacks and determine register values of other processes.

Note: This vulnerability is known as LazyFP.


3) Use-after-free error (CVE-ID: CVE-2018-10675)

The vulnerability allows a local attacker to cause DoS condition on the target system.

The weakness exists in the do_get_mempolicy function in mm/mempolicy.c due to use-after-free error. A local attacker can use specially crafted system calls, trigger memory corruption and cause the service to crash.


4) Denial of service (CVE-ID: CVE-2018-10872)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to a flaw in the way the Linux kernel handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, processor does not deliver interrupts and exceptions, they are delivered once the first instruction after the stack switch is executed. A remote attacker can crash the system kernel resulting in DoS.


5) Privilege escalation (CVE-ID: CVE-2018-8897)

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The vulnerability exists due to improper implementation of Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) on multiple system kernels, which results in an unexpected behavior for #DB exceptions that are deferred by MOV SS or POP SS. A local user can execute arbitrary code with elevated privileges.


Remediation

Install update from vendor's website.

References