SB2018103058 - Red Hat Enterprise Linux 7 update for kernel-alt

Description

This security bulletin contains information about 42 secuirty vulnerabilities.

1) Privilege escalation (CVE-ID: CVE-2017-13166)

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists in the V4L2 video driver component of the Google Android kernel due to insufficient validation of user-supplied input. A local attacker can use a specially crafted application and execute arbitrary code with elevated privileges.

Successful exploitation of the vulnerability may result in system compromise.

2) Use after free (CVE-ID: CVE-2017-16648)

The vulnerability allows a local user to execute arbitrary code.

The dvb_frontend_free function in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device. NOTE: the function was later renamed __dvb_frontend_free.

3) Improper input validation (CVE-ID: CVE-2017-17805)

The vulnerability allows a local attacker to cause DoS condition on the target system.

The weakness exists due to the Salsa20 encryption algorithm in the Linux kernel does not correctly handle zero-length inputs. A local attacker able to use the AF_ALG-based skcipher interface (CONFIG_CRYPTO_USER_API_SKCIPHER) can trigger uninitialized-memory free and cause the kernel to crash or execute a specially crafted sequence of system calls that use the blkcipher_walk API.

Successful exploitation of the vulnerability results in denial of service.

4) Stack-based buffer overflow (CVE-ID: CVE-2017-17806)

The vulnerability allows a local attacker to cause DoS condition on the target system.

The weakness exists due to the HMAC implementation (crypto/hmac.c) in the Linux kernel does not validate that the underlying cryptographic hash algorithm is unkeyed. A local attacker able to use the AF_ALG-based hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) can execute a specially crafted sequence of system calls that encounter a missing SHA-3 initialization, trigger kernel stack buffer overflow and cause the system to crash.

Successful exploitation of the vulnerability results in denial of service.

5) Resource management errors (CVE-ID: CVE-2017-18075)

The vulnerability allows a local attacker to cause DoS condition on the target system.

The weakness exists in crypto/pcrypt.c due to mishandling freeing instances. A local attacker can gain access to the AF_ALG-based AEAD interface (CONFIG_CRYPTO_USER_API_AEAD) and pcrypt (CONFIG_CRYPTO_PCRYPT), execute a crafted sequence of system calls and cause the service to crash (kfree of an incorrect pointer).

6) Infinite loop (CVE-ID: CVE-2017-18208)

The vulnerability allows a local attacker to cause DoS condition on the target system.

The weakness exists in the madvise_willneed function due to infinite loop. A local attacker can trigger use of MADVISE_WILLNEED for a DAX mapping and cause the service to crash.

7) Out-of-bounds read (CVE-ID: CVE-2017-18344)

The vulnerability allows a local attacker to obtain potentially sensitive information.

The vulnerability exists due to out-of-bounds memory read error in the 'sigevent->sigev_notify' field of show_timer() function in the timer subsystem. A local attacker can obtain potentially sensitive information from system memory.

8) Null pointer dereference (CVE-ID: CVE-2018-1065)

The vulnerability allows a local attacker to cause DoS condition no the target system.

The weakness exists due to NULL pointer dereference. A local attacker with the capability to insert iptables/netfilter rules can leverage the CAP_NET_RAW or CAP_NET_ADMIN capability, related to arpt_do_table in net/ipv4/netfilter/arp_tables.c, ipt_do_table in net/ipv4/netfilter/ip_tables.c, and ip6t_do_table in net/ipv6/netfilter/ip6_tables.c, trigger a jump to an invalid chain and cause the system to crash.

9) Privilege escalation (CVE-ID: CVE-2018-1068)

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists due to an error in the implementation of 32 bit syscall interface. A local attacker can gain root privileges.

10) NULL pointer dereference (CVE-ID: CVE-2018-1092)

The vulnerability allows a local attacker to cause DoS condition on the target system.

The weakness exists due to improper processing of a customized ext4 image when using the ext4_iget function, as defined in the fs/ext4/inode.c source code file. A local attacker can mount a customized ext4 image, trigger NULL pointer dereference and an Out-of-Process Space (OOPS) kernel memory error and cause the service to crash.

11) NULL pointer dereference (CVE-ID: CVE-2018-1094)

The vulnerability allows a local attacker to cause DoS condition on the target system.

The weakness exists due to improper initialization of the crc32c checksum driver when using the ext4_fill_super function, as defined in the fs/ext4/super.c source code file. A local attacker can mount a customized ext4 image, trigger NULL pointer dereference in the ext4/xattr.c:ext4_xattr_inode_hash() function and cause the service to crash.

12) NULL pointer dereference (CVE-ID: CVE-2018-1095)

The vulnerability allows a remote authenticated attacker to cause DoS condition on the target system.

The weakness exists in the ext4_xattr_check_entries function in fs/ext4/xattr.c due to improper validation of xattr sizes, which causes misinterpretation of a size as an error code. A remote attacker can submit a specially crafted ext4 image, trigger NULL pointer dereference and cause the service to crash.

13) NULL pointer dereference (CVE-ID: CVE-2018-1095)

The vulnerability allows a local attacker to cause DoS condition on the target system.

The weakness exists due to improper validation of xattr sizes when using the ext4_xattr_check_entries function, as defined in the fs/ext4/super.c source code file. A local attacker can mount a malicious ext4 image, trigger NULL pointer dereference in the fs/posix_acl.c:get_acl() function and cause the service to crash.

14) Improper initialization (CVE-ID: CVE-2018-1118)

The vulnerability allows a local attacker to obtain potentially sensitive information on the target system.

The weakness exists in the vhost/vhost.c:vhost_new_msg() function due to improper initialization of memory in messages that are passed between virtual guests and the host operating system. A local attacker can read from the /dev/vhost-net device file and read sensitive kernel memory information.

15) Improper input validation (CVE-ID: CVE-2018-1120)

The vulnerability allows a local user to cause DoS condition on the target system.

The weakness exists due to insufficient validation of user-supplied input. A local user can block any read() access to /proc/PID/cmdline by mmap()ing a FUSE file (Filesystem in Userspace) onto this process's command-line arguments, block pgrep, pidof, pkill, ps, and w, either forever (a denial of service), or for some controlled time (a synchronization tool for exploiting other vulnerabilities).

16) Speculative Store Bypass (CVE-ID: CVE-2018-3639)

The vulnerability allows a local attacker to obtain potentially sensitive information on the target system.

The weakness exists due to race conditions in CPU cache processing. A local attacker can conduct a side-channel attack to exploit a flaw in the speculative execution of Load and Store instructions to read privileged memory.

Note: the vulnerability is referred to as "Spectre variant 4".

17) Use-after-free error (CVE-ID: CVE-2018-5344)

The vulnerability allows a local attacker to cause a DoS condition on the target system.

The weakness exists in the drivers/block/loop.c mishandles lo_release serialization due to use-after-free error. A local attacker can trigger memory corruption and cause the service to crash or execute arbitrary code.

Successful exploitation of the vulnerability may result in system compromise.

18) Resource exhaustion (CVE-ID: CVE-2018-5390)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to the system uses an inefficient TCP reassembly algorithm. A remote attacker can send specially crafted packets within ongoing TCP sessions to consume excessive CPU resources and cause the service to crash.

Note: The issue has been called "SegmentSmack".

19) Improper input validation (CVE-ID: CVE-2018-5391)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to an error when handling reassembly of fragmented IPv4 and IPv6 packets. A remote attacker can send specially crafted packets, trigger time and calculation expensive fragment reassembly algorithms and cause the service to crash.

20) Privilege escalation (CVE-ID: CVE-2018-5750)

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists due to a flaw in the acpi_smbus_hc_add() function in 'drivers/acpi/sbshc.c'. A local attacker can submit a specially crafted SBS HC printk system call to obtain potentially sensitive address information and potentially bypass kernel address space layout randomization (KASLR) security protection.

21) Memory corruption (CVE-ID: CVE-2018-5803)

The vulnerability allows a local attacker to cause DoS condition on the target system.

The weakness exists in the _sctp_make_chunk() function due to boundary error. A local attacker can submit a crafted SCTP packet, trigger memory corruption and cause the service to crash.

22) Integer overflow (CVE-ID: CVE-2018-5848)

23) Memory corruption (CVE-ID: CVE-2018-7566)

The vulnerability allows a local attacker to write arbitrary files on the target system.

The weakness exists due to out-of-bounds write while ALSA sequencer core initializes the event pool on demand by invoking snd_seq_pool_init() when the first write happens and the pool is empty. A local attacker can trigger buffer overflow and use after free and reset the pool size manually via ioctl concurrently and write arbitrary files.

24) Memory leak (CVE-ID: CVE-2018-7757)

The vulnerability allows a local attacker to cause DoS condition on the target system.

The weakness exists in the drivers/scsi/libsas/sas_expander.c source code in the sas_smp_get_phy_events function due to memory leak. A local attacker can trigger memory corruption and cause the system to crash.

25) Integer overflow (CVE-ID: CVE-2018-8781)

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists in the udl_fb_mmap function in drivers/gpu/drm/udl/udl_fb.c due to integer overflow. A local attacker can gain full read and write permissions on kernel physical pages and execute arbitrary code.

Successful exploitation of the vulnerability may result in system compromise.

26) Buffer overflow (CVE-ID: CVE-2018-9363)

The vulnerability allows an attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error within the hidp_process_report when processing Bluetooth packets. An attacker with physical proximity to the system can send specially crafted traffic, trigger memory corruption and perform denial of service attack or execute arbitrary code.

27) NULL pointer dereference (CVE-ID: CVE-2018-10322)

The vulnerability allows a local attacker to cause DoS condition on the target system.

The weakness exists in the xfs_dinode_verify function in the xfs/xfs/libxfs/xfs_inode_buf.c source code file due to NULL pointer dereference when handling Extended File System (XFS) images. A local attacker can mount a specially crafted XFS filesystem image when filesystem operations are executed on the mounted image and cause the service to crash.

28) Out-of-bounds read (CVE-ID: CVE-2018-10877)

The vulnerability allows a local privileged user to execute arbitrary code.

Linux kernel ext4 filesystem is vulnerable to an out-of-bound access in the ext4_ext_drop_refs() function when operating on a crafted ext4 filesystem image.

29) Out-of-bounds write (CVE-ID: CVE-2018-10878)

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The vulnerability exists due to out-of-bounds write error in the ext4_init_block_bitmap() function in the fourth extended filesystem (ext4). A local attacker can mount and operate a specially crafted ext4 filesystem image, trigger memory corruption and cause the service to crash or execute arbitrary code with elevated privileges.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

30) Use-after-free (CVE-ID: CVE-2018-10879)

The vulnerability allows a local authenticated user to execute arbitrary code.

A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause a use-after-free in ext4_xattr_set_entry function and a denial of service or unspecified other impact may occur by renaming a file in a crafted ext4 filesystem image.

31) Out-of-bounds write (CVE-ID: CVE-2018-10880)

The vulnerability allows a local non-authenticated attacker to perform a denial of service (DoS) attack.

Linux kernel is vulnerable to a stack-out-of-bounds write in the ext4 filesystem code when mounting and writing to a crafted ext4 image in ext4_update_inline_data(). An attacker could use this to cause a system crash and a denial of service.

32) Buffer overflow (CVE-ID: CVE-2018-10881)

The vulnerability allows a local authenticated user to perform a denial of service (DoS) attack.

A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound access in ext4_get_group_info function, a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image.

33) Out-of-bounds write (CVE-ID: CVE-2018-10882)

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The vulnerability exists due to out-of-bounds write error in the fs/jbd2/transaction.csource code in the fourth extended filesystem (ext4). A local attacker can unmount a specially crafted ext4 filesystem image, trigger memory corruption and cause the service to crash or execute arbitrary code with elevated privileges.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

34) Out-of-bounds write (CVE-ID: CVE-2018-10883)

The vulnerability allows a local authenticated user to perform a denial of service (DoS) attack.

A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bounds write in jbd2_journal_dirty_metadata(), a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image.

35) Information disclosure (CVE-ID: CVE-2018-10940)

The vulnerability allows a local attacker to obtain potentially sensitive information.

The vulnerability exists in the cdrom_ioctl_media_changed function due to incorrect bounds check in the CDROM driver CDROM_MEDIA_CHANGED IOCTL. A local attacker can execute a file or program that submits malicious input to the targeted system, trigger memory corruption and access sensitive kernel information, which could be used to conduct further attacks.

36) Stack-based buffer overflow (CVE-ID: CVE-2018-11506)

The vulnerability allows a local attacker to cause DoS condition on the target system.

The vulnerability exists in the sr_do_ioctl function, as defined in the drivers/scsi/sr_ioctl.c source code file due to differing buffer sizes in the CDROM layer and the SCSI layer. A local attacker can submit specially crafted input, trigger a stack-based overflow and cause the system to crash.

37) Race condition (CVE-ID: CVE-2018-12232)

The vulnerability allows a local attacker to cause DoS condition on the target system.

The vulnerability exists in the net/socket.c source code file due to the fchownat() function does not increment the reference count of a socket file descriptor, which could trigger a race condition between the sock_close() and sockfs_setattr() functions. A local attacker can submit specially crafted input, trigger a NULL pointer dereference condition and cause the system to crash..

38) Security restrictions bypass (CVE-ID: CVE-2018-13405)

The vulnerability allows a local attacker to create arbitrary files on the target system.

The vulnerability exists due to the inode_init_owner function, as defined in the fs/inode.c source code file, allows the creation of arbitrary files in set-group identification (SGID) directories. A local attacker can create arbitrary files with unintended group ownership.

39) Use-after-free error (CVE-ID: CVE-2018-14619)

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The vulnerability exists in the crypto subsystem of the Linux Kerneldue to incorrect reference to the null skcipher held by each transformation object (TFM), improperly placed when each af_alg_ctx is freed from an affected device. A local attacker can use a custom program, cause the null skcipher to be freed while it is still in use and gain elevated privileges on an affected device.

40) Input validation error (CVE-ID: CVE-2018-14641)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

A security flaw was found in the ip_frag_reasm() function in net/ipv4/ip_fragment.c in the Linux kernel from 4.19-rc1 to 4.19-rc3 inclusive, which can cause a later system crash in ip_do_fragment(). With certain non-default, but non-rare, configuration of a victim host, an attacker can trigger this crash remotely, thus leading to a remote denial-of-service.

41) Improper input validation (CVE-ID: CVE-2018-1000026)

The vulnerability allows a remote authenticated attacker to cause DoS condition on the target system.

The weakness exists in the bnx2x network card driver due to insufficient validation of user-supplied input. A remote attacker can submit a specially crafted packet to the affected network card and cause the system to crash.

42) Null pointer dereference (CVE-ID: CVE-2018-1000200)

Remediation

Install update from vendor's website.

References

• https://access.redhat.com/errata/RHSA-2018:2948