[RHSA-2016:1539-01] Important: kernel security and bug fix update

[news 28]

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1

 

=====================================================================

Red Hat Security Advisory

 

Synopsis: Important: kernel security and bug fix update

Advisory ID: RHSA-2016:1539-01

Product: Red Hat Enterprise Linux

Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-1539.html

Issue date: 2016-08-02

CVE Names: CVE-2015-8660 CVE-2016-2143 CVE-2016-4470

=====================================================================

 

1. Summary:

 

An update for kernel is now available for Red Hat Enterprise Linux 7.

 

Red Hat Product Security has rated this update as having a security impact

of Important. A Common Vulnerability Scoring System (CVSS) base score,

which gives a detailed severity rating, is available for each vulnerability

from the CVE link(s) in the References section.

 

2. Relevant releases/architectures:

 

Red Hat Enterprise Linux Client (v. 7) - noarch, x86_64

Red Hat Enterprise Linux Client Optional (v. 7) - x86_64

Red Hat Enterprise Linux ComputeNode (v. 7) - noarch, x86_64

Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64

Red Hat Enterprise Linux Server (v. 7) - noarch, ppc64, ppc64le, s390x, x86_64

Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, x86_64

Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64

Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64

 

3. Description:

 

The kernel packages contain the Linux kernel, the core of any Linux

operating system.

 

These updated kernel packages include several security issues and numerous

bug fixes, some of which you can see below. Space precludes documenting

all of these bug fixes in this advisory. To see the complete list of bug

fixes, users are directed to the related Knowledge Article:

https://access.redhat.com/articles/2460971.

 

Security Fix(es):

 

* A flaw was found in the Linux kernel's keyring handling code, where in

key_reject_and_link() an uninitialised variable would eventually lead to

arbitrary free address which could allow attacker to use a use-after-free

style attack. (CVE-2016-4470, Important)

 

* The ovl_setattr function in fs/overlayfs/inode.c in the Linux kernel

through 4.3.3 attempts to merge distinct setattr operations, which allows

local users to bypass intended access restrictions and modify the

attributes of arbitrary overlay files via a crafted application.

(CVE-2015-8660, Moderate)

 

* It was reported that on s390x, the fork of a process with four page table

levels will cause memory corruption with a variety of symptoms. All

processes are created with three level page table and a limit of 4TB for

the address space. If the parent process has four page table levels with a

limit of 8PB, the function that duplicates the address space will try to

copy memory areas outside of the address space limit for the child process.

(CVE-2016-2143, Moderate)

 

Red Hat would like to thank Nathan Williams for reporting CVE-2015-8660.

The CVE-2016-4470 issue was discovered by David Howells (Red Hat Inc.).

 

Bug Fix(es):

 

* The glibc headers and the Linux headers share certain definitions of

key structures that are required to be defined in kernel and in userspace.

In some instances both userspace and sanitized kernel headers have to be

included in order to get the structure definitions required by the user

program. Unfortunately because the glibc and Linux headers don't

coordinate this can result in compilation errors. The glibc headers have

therefore been fixed to coordinate with Linux UAPI-based headers. With

the header coordination compilation errors no longer occur. (BZ#1331285)

 

* When running the TCP/IPv6 traffic over the mlx4_en networking interface

on the big endian architectures, call traces reporting about a "hw csum

failure" could occur. With this update, the mlx4_en driver has been fixed

by correction of the checksum calculation for the big endian

architectures. As a result, the call trace error no longer appears

in the log messages. (BZ#1337431)

 

* Under significant load, some applications such as logshifter could

generate bursts of log messages too large for the system logger to spool.

Due to a race condition, log messages from that application could then be

lost even after the log volume dropped to manageable levels. This update

fixes the kernel mechanism used to notify the transmitter end of the

socket used by the system logger that more space is available on the

receiver side, removing a race condition which previously caused the

sender to stop transmitting new messages and allowing all log messages

to be processed correctly. (BZ#1337513)

 

* Previously, after heavy open or close of the Accelerator Function Unit

(AFU) contexts, the interrupt packet went out and the AFU context did not

see any interrupts. Consequently, a kernel panic could occur. The provided

patch set fixes handling of the interrupt requests, and kernel panic no

longer occurs in the described situation. (BZ#1338886)

 

* net: recvfrom would fail on short buffer. (BZ#1339115)

* Backport rhashtable changes from upstream. (BZ#1343639)

* Server Crashing after starting Glusterd & creating volumes. (BZ#1344234)

* RAID5 reshape deadlock fix. (BZ#1344313)

* BDX perf uncore support fix. (BZ#1347374)

 

4. Solution:

 

For details on how to apply this update, which includes the changes

described in this advisory, refer to:

 

https://access.redhat.com/articles/11258

 

The system must be rebooted for this update to take effect.

 

5. Bugs fixed (https://bugzilla.redhat.com/):

 

1291329 - CVE-2015-8660 kernel: Permission bypass on overlayfs during copy_up

1308908 - CVE-2016-2143 kernel: Fork of large process causes memory corruption

1341716 - CVE-2016-4470 kernel: Uninitialized variable in request_key handling causes kernel crash in error handling path

 

6. Package List:

 

Red Hat Enterprise Linux Client (v. 7):

 

Source:

kernel-3.10.0-327.28.2.el7.src.rpm

 

noarch:

kernel-abi-whitelists-3.10.0-327.28.2.el7.noarch.rpm

kernel-doc-3.10.0-327.28.2.el7.noarch.rpm

 

x86_64:

kernel-3.10.0-327.28.2.el7.x86_64.rpm

kernel-debug-3.10.0-327.28.2.el7.x86_64.rpm

kernel-debug-debuginfo-3.10.0-327.28.2.el7.x86_64.rpm

kernel-debug-devel-3.10.0-327.28.2.el7.x86_64.rpm

kernel-debuginfo-3.10.0-327.28.2.el7.x86_64.rpm

kernel-debuginfo-common-x86_64-3.10.0-327.28.2.el7.x86_64.rpm

kernel-devel-3.10.0-327.28.2.el7.x86_64.rpm

kernel-headers-3.10.0-327.28.2.el7.x86_64.rpm

kernel-tools-3.10.0-327.28.2.el7.x86_64.rpm

kernel-tools-debuginfo-3.10.0-327.28.2.el7.x86_64.rpm

kernel-tools-libs-3.10.0-327.28.2.el7.x86_64.rpm

perf-3.10.0-327.28.2.el7.x86_64.rpm

perf-debuginfo-3.10.0-327.28.2.el7.x86_64.rpm

python-perf-3.10.0-327.28.2.el7.x86_64.rpm

python-perf-debuginfo-3.10.0-327.28.2.el7.x86_64.rpm

 

Red Hat Enterprise Linux Client Optional (v. 7):

 

x86_64:

kernel-debug-debuginfo-3.10.0-327.28.2.el7.x86_64.rpm

kernel-debuginfo-3.10.0-327.28.2.el7.x86_64.rpm

kernel-debuginfo-common-x86_64-3.10.0-327.28.2.el7.x86_64.rpm

kernel-tools-debuginfo-3.10.0-327.28.2.el7.x86_64.rpm

kernel-tools-libs-devel-3.10.0-327.28.2.el7.x86_64.rpm

perf-debuginfo-3.10.0-327.28.2.el7.x86_64.rpm

python-perf-debuginfo-3.10.0-327.28.2.el7.x86_64.rpm

 

Red Hat Enterprise Linux ComputeNode (v. 7):

 

Source:

kernel-3.10.0-327.28.2.el7.src.rpm

 

noarch:

kernel-abi-whitelists-3.10.0-327.28.2.el7.noarch.rpm

kernel-doc-3.10.0-327.28.2.el7.noarch.rpm

 

x86_64:

kernel-3.10.0-327.28.2.el7.x86_64.rpm

kernel-debug-3.10.0-327.28.2.el7.x86_64.rpm

kernel-debug-debuginfo-3.10.0-327.28.2.el7.x86_64.rpm

kernel-debug-devel-3.10.0-327.28.2.el7.x86_64.rpm

kernel-debuginfo-3.10.0-327.28.2.el7.x86_64.rpm

kernel-debuginfo-common-x86_64-3.10.0-327.28.2.el7.x86_64.rpm

kernel-devel-3.10.0-327.28.2.el7.x86_64.rpm

kernel-headers-3.10.0-327.28.2.el7.x86_64.rpm

kernel-tools-3.10.0-327.28.2.el7.x86_64.rpm

kernel-tools-debuginfo-3.10.0-327.28.2.el7.x86_64.rpm

kernel-tools-libs-3.10.0-327.28.2.el7.x86_64.rpm

perf-3.10.0-327.28.2.el7.x86_64.rpm

perf-debuginfo-3.10.0-327.28.2.el7.x86_64.rpm

python-perf-3.10.0-327.28.2.el7.x86_64.rpm

python-perf-debuginfo-3.10.0-327.28.2.el7.x86_64.rpm

 

Red Hat Enterprise Linux ComputeNode Optional (v. 7):

 

x86_64:

kernel-debug-debuginfo-3.10.0-327.28.2.el7.x86_64.rpm

kernel-debuginfo-3.10.0-327.28.2.el7.x86_64.rpm

kernel-debuginfo-common-x86_64-3.10.0-327.28.2.el7.x86_64.rpm

kernel-tools-debuginfo-3.10.0-327.28.2.el7.x86_64.rpm

kernel-tools-libs-devel-3.10.0-327.28.2.el7.x86_64.rpm

perf-debuginfo-3.10.0-327.28.2.el7.x86_64.rpm

python-perf-debuginfo-3.10.0-327.28.2.el7.x86_64.rpm

 

Red Hat Enterprise Linux Server (v. 7):

 

Source:

kernel-3.10.0-327.28.2.el7.src.rpm

 

noarch:

kernel-abi-whitelists-3.10.0-327.28.2.el7.noarch.rpm

kernel-doc-3.10.0-327.28.2.el7.noarch.rpm

 

ppc64:

kernel-3.10.0-327.28.2.el7.ppc64.rpm

kernel-bootwrapper-3.10.0-327.28.2.el7.ppc64.rpm

kernel-debug-3.10.0-327.28.2.el7.ppc64.rpm

kernel-debug-debuginfo-3.10.0-327.28.2.el7.ppc64.rpm

kernel-debug-devel-3.10.0-327.28.2.el7.ppc64.rpm

kernel-debuginfo-3.10.0-327.28.2.el7.ppc64.rpm

kernel-debuginfo-common-ppc64-3.10.0-327.28.2.el7.ppc64.rpm

kernel-devel-3.10.0-327.28.2.el7.ppc64.rpm

kernel-headers-3.10.0-327.28.2.el7.ppc64.rpm

kernel-tools-3.10.0-327.28.2.el7.ppc64.rpm

kernel-tools-debuginfo-3.10.0-327.28.2.el7.ppc64.rpm

kernel-tools-libs-3.10.0-327.28.2.el7.ppc64.rpm

perf-3.10.0-327.28.2.el7.ppc64.rpm

perf-debuginfo-3.10.0-327.28.2.el7.ppc64.rpm

python-perf-3.10.0-327.28.2.el7.ppc64.rpm

python-perf-debuginfo-3.10.0-327.28.2.el7.ppc64.rpm

 

ppc64le:

kernel-3.10.0-327.28.2.el7.ppc64le.rpm

kernel-bootwrapper-3.10.0-327.28.2.el7.ppc64le.rpm

kernel-debug-3.10.0-327.28.2.el7.ppc64le.rpm

kernel-debug-debuginfo-3.10.0-327.28.2.el7.ppc64le.rpm

kernel-debuginfo-3.10.0-327.28.2.el7.ppc64le.rpm

kernel-debuginfo-common-ppc64le-3.10.0-327.28.2.el7.ppc64le.rpm

kernel-devel-3.10.0-327.28.2.el7.ppc64le.rpm

kernel-headers-3.10.0-327.28.2.el7.ppc64le.rpm

kernel-tools-3.10.0-327.28.2.el7.ppc64le.rpm

kernel-tools-debuginfo-3.10.0-327.28.2.el7.ppc64le.rpm

kernel-tools-libs-3.10.0-327.28.2.el7.ppc64le.rpm

perf-3.10.0-327.28.2.el7.ppc64le.rpm

perf-debuginfo-3.10.0-327.28.2.el7.ppc64le.rpm

python-perf-3.10.0-327.28.2.el7.ppc64le.rpm

python-perf-debuginfo-3.10.0-327.28.2.el7.ppc64le.rpm

 

s390x:

kernel-3.10.0-327.28.2.el7.s390x.rpm

kernel-debug-3.10.0-327.28.2.el7.s390x.rpm

kernel-debug-debuginfo-3.10.0-327.28.2.el7.s390x.rpm

kernel-debug-devel-3.10.0-327.28.2.el7.s390x.rpm

kernel-debuginfo-3.10.0-327.28.2.el7.s390x.rpm

kernel-debuginfo-common-s390x-3.10.0-327.28.2.el7.s390x.rpm

kernel-devel-3.10.0-327.28.2.el7.s390x.rpm

kernel-headers-3.10.0-327.28.2.el7.s390x.rpm

kernel-kdump-3.10.0-327.28.2.el7.s390x.rpm

kernel-kdump-debuginfo-3.10.0-327.28.2.el7.s390x.rpm

kernel-kdump-devel-3.10.0-327.28.2.el7.s390x.rpm

perf-3.10.0-327.28.2.el7.s390x.rpm

perf-debuginfo-3.10.0-327.28.2.el7.s390x.rpm

python-perf-3.10.0-327.28.2.el7.s390x.rpm

python-perf-debuginfo-3.10.0-327.28.2.el7.s390x.rpm

 

x86_64:

kernel-3.10.0-327.28.2.el7.x86_64.rpm

kernel-debug-3.10.0-327.28.2.el7.x86_64.rpm

kernel-debug-debuginfo-3.10.0-327.28.2.el7.x86_64.rpm

kernel-debug-devel-3.10.0-327.28.2.el7.x86_64.rpm

kernel-debuginfo-3.10.0-327.28.2.el7.x86_64.rpm

kernel-debuginfo-common-x86_64-3.10.0-327.28.2.el7.x86_64.rpm

kernel-devel-3.10.0-327.28.2.el7.x86_64.rpm

kernel-headers-3.10.0-327.28.2.el7.x86_64.rpm

kernel-tools-3.10.0-327.28.2.el7.x86_64.rpm

kernel-tools-debuginfo-3.10.0-327.28.2.el7.x86_64.rpm

kernel-tools-libs-3.10.0-327.28.2.el7.x86_64.rpm

perf-3.10.0-327.28.2.el7.x86_64.rpm

perf-debuginfo-3.10.0-327.28.2.el7.x86_64.rpm

python-perf-3.10.0-327.28.2.el7.x86_64.rpm

python-perf-debuginfo-3.10.0-327.28.2.el7.x86_64.rpm

 

Red Hat Enterprise Linux Server Optional (v. 7):

 

ppc64:

kernel-debug-debuginfo-3.10.0-327.28.2.el7.ppc64.rpm

kernel-debuginfo-3.10.0-327.28.2.el7.ppc64.rpm

kernel-debuginfo-common-ppc64-3.10.0-327.28.2.el7.ppc64.rpm

kernel-tools-debuginfo-3.10.0-327.28.2.el7.ppc64.rpm

kernel-tools-libs-devel-3.10.0-327.28.2.el7.ppc64.rpm

perf-debuginfo-3.10.0-327.28.2.el7.ppc64.rpm

python-perf-debuginfo-3.10.0-327.28.2.el7.ppc64.rpm

 

ppc64le:

kernel-debug-debuginfo-3.10.0-327.28.2.el7.ppc64le.rpm

kernel-debug-devel-3.10.0-327.28.2.el7.ppc64le.rpm

kernel-debuginfo-3.10.0-327.28.2.el7.ppc64le.rpm

kernel-debuginfo-common-ppc64le-3.10.0-327.28.2.el7.ppc64le.rpm

kernel-tools-debuginfo-3.10.0-327.28.2.el7.ppc64le.rpm

kernel-tools-libs-devel-3.10.0-327.28.2.el7.ppc64le.rpm

perf-debuginfo-3.10.0-327.28.2.el7.ppc64le.rpm

python-perf-debuginfo-3.10.0-327.28.2.el7.ppc64le.rpm

 

x86_64:

kernel-debug-debuginfo-3.10.0-327.28.2.el7.x86_64.rpm

kernel-debuginfo-3.10.0-327.28.2.el7.x86_64.rpm

kernel-debuginfo-common-x86_64-3.10.0-327.28.2.el7.x86_64.rpm

kernel-tools-debuginfo-3.10.0-327.28.2.el7.x86_64.rpm

kernel-tools-libs-devel-3.10.0-327.28.2.el7.x86_64.rpm

perf-debuginfo-3.10.0-327.28.2.el7.x86_64.rpm

python-perf-debuginfo-3.10.0-327.28.2.el7.x86_64.rpm

 

Red Hat Enterprise Linux Workstation (v. 7):

 

Source:

kernel-3.10.0-327.28.2.el7.src.rpm

 

noarch:

kernel-abi-whitelists-3.10.0-327.28.2.el7.noarch.rpm

kernel-doc-3.10.0-327.28.2.el7.noarch.rpm

 

x86_64:

kernel-3.10.0-327.28.2.el7.x86_64.rpm

kernel-debug-3.10.0-327.28.2.el7.x86_64.rpm

kernel-debug-debuginfo-3.10.0-327.28.2.el7.x86_64.rpm

kernel-debug-devel-3.10.0-327.28.2.el7.x86_64.rpm

kernel-debuginfo-3.10.0-327.28.2.el7.x86_64.rpm

kernel-debuginfo-common-x86_64-3.10.0-327.28.2.el7.x86_64.rpm

kernel-devel-3.10.0-327.28.2.el7.x86_64.rpm

kernel-headers-3.10.0-327.28.2.el7.x86_64.rpm

kernel-tools-3.10.0-327.28.2.el7.x86_64.rpm

kernel-tools-debuginfo-3.10.0-327.28.2.el7.x86_64.rpm

kernel-tools-libs-3.10.0-327.28.2.el7.x86_64.rpm

perf-3.10.0-327.28.2.el7.x86_64.rpm

perf-debuginfo-3.10.0-327.28.2.el7.x86_64.rpm

python-perf-3.10.0-327.28.2.el7.x86_64.rpm

python-perf-debuginfo-3.10.0-327.28.2.el7.x86_64.rpm

 

Red Hat Enterprise Linux Workstation Optional (v. 7):

 

x86_64:

kernel-debug-debuginfo-3.10.0-327.28.2.el7.x86_64.rpm

kernel-debuginfo-3.10.0-327.28.2.el7.x86_64.rpm

kernel-debuginfo-common-x86_64-3.10.0-327.28.2.el7.x86_64.rpm

kernel-tools-debuginfo-3.10.0-327.28.2.el7.x86_64.rpm

kernel-tools-libs-devel-3.10.0-327.28.2.el7.x86_64.rpm

perf-debuginfo-3.10.0-327.28.2.el7.x86_64.rpm

python-perf-debuginfo-3.10.0-327.28.2.el7.x86_64.rpm

 

These packages are GPG signed by Red Hat for security. Our key and

details on how to verify the signature are available from

https://access.redhat.com/security/team/key/

 

7. References:

 

https://access.redhat.com/security/cve/CVE-2015-8660

https://access.redhat.com/security/cve/CVE-2016-2143

https://access.redhat.com/security/cve/CVE-2016-4470

https://access.redhat.com/security/updates/classification/#important

https://access.redhat.com/articles/2460971

 

8. Contact:

 

The Red Hat security contact is . More contact

details at https://access.redhat.com/security/team/contact/

 

Copyright 2016 Red Hat, Inc.

-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1

 

iD8DBQFXoR0TXlSAg2UNWIIRAvjnAJsHgdzb+uIGBU2qFbo1WViyZ3Q+mgCeMSct

rYt7kZ6fTSk+GeFuP7S+jrM=

=A2Lp

-----END PGP SIGNATURE-----

 

 

--