RHSA-2018:3083HighCVSS 7.8

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Published
October 30, 2018
Last Modified
November 5, 2026

🔗 CVE IDs covered (31)

CVE-2018-8781 →CVE-2018-10883 →CVE-2017-0861 →CVE-2018-1094 →CVE-2018-7740 →CVE-2018-7757 →CVE-2018-10322 →CVE-2018-10902 →CVE-2018-1130 →CVE-2018-18690 →CVE-2018-10878 →CVE-2017-10661 →CVE-2017-18360 →CVE-2018-5848 →CVE-2018-1000026 →CVE-2017-18232 →CVE-2018-5391 →CVE-2018-5803 →CVE-2018-10940 →CVE-2017-18208 →CVE-2018-1092 →CVE-2018-5344 →CVE-2018-10881 →CVE-2015-8830 →CVE-2017-18344 →CVE-2018-1118 →CVE-2018-10879 →CVE-2018-13405 →CVE-2016-4913 →CVE-2017-17805 →CVE-2018-1120 →

📋 Description

CVE-2015-8830 — kernel: AIO write triggers integer overflow in some protocols CVE-2016-4913 — kernel: Information leak when handling NM entries containing NUL CVE-2017-0861 — kernel: Use-after-free in snd_pcm_info function in ALSA subsystem potentially leads to privilege escalation CVE-2017-10661 — kernel: Handling of might_cancel queueing is not properly pretected against race CVE-2017-17805 — kernel: Salsa20 encryption algorithm does not correctly handle zero-length inputs allowing local attackers to cause denial-of-service CVE-2017-18208 — kernel: Inifinite loop vulnerability in mm/madvise.c:madvise_willneed() function allows local denial of service CVE-2017-18232 — kernel: Mishandling mutex within libsas allowing local Denial of Service CVE-2017-18344 — kernel: out-of-bounds access in the show_timer function in kernel/time/posix-timers.c CVE-2017-18360 — kernel: Division by zero in change_port_settings in drivers/usb/serial/io_ti.c resulting in a denial of service CVE-2018-1092 — kernel: NULL pointer dereference in ext4/mballoc.c:ext4_process_freed_data() when mounting crafted ext4 image CVE-2018-1094 — kernel: NULL pointer dereference in ext4/xattr.c:ext4_xattr_inode_hash() causes crash with crafted ext4 image CVE-2018-1118 — kernel: vhost: Information disclosure in vhost/vhost.c:vhost_new_msg() CVE-2018-1120 — kernel: fuse-backed file mmap-ed onto process cmdline arguments causes denial of service CVE-2018-1130 — kernel: a null pointer dereference in net/dccp/output.c:dccp_write_xmit() leads to a system crash CVE-2018-5344 — kernel: drivers/block/loop.c mishandles lo_release serialization allowing denial-of-service CVE-2018-5391 — kernel: IP fragments with random offsets allow a remote denial of service (FragmentSmack) CVE-2018-5803 — kernel: Missing length check of payload in net/sctp/sm_make_chunk.c:_sctp_make_chunk() function allows denial of service CVE-2018-5848 — kernel: buffer overflow in drivers/net/wireless/ath/wil6210/wmi.c:wmi_set_ie() may lead to memory corruption CVE-2018-7740 — kernel: Denial of service in resv_map_release function in mm/hugetlb.c CVE-2018-7757 — kernel: Memory leak in the sas_smp_get_phy_events function in drivers/scsi/libsas/sas_expander.c CVE-2018-8781 — kernel: Integer overflow in drivers/gpu/drm/udl/udl_fb.c:udl_fb_mmap() can allow attackers to execute code in kernel space CVE-2018-10322 — kernel: Invalid pointer dereference in xfs_ilock_attr_map_shared() when mounting crafted xfs image allowing denial of service CVE-2018-10878 — kernel: out-of-bound write in ext4_init_block_bitmap function with a crafted ext4 image CVE-2018-10879 — kernel: use-after-free detected in ext4_xattr_set_entry with a crafted file CVE-2018-10881 — kernel: out-of-bound access in ext4_get_group_info() when mounting and operating a crafted ext4 image CVE-2018-10883 — kernel: stack-out-of-bounds write in jbd2_journal_dirty_metadata function CVE-2018-10902 — kernel: MIDI driver race condition leads to a double-free CVE-2018-10940 — kernel: incorrect memory bounds check in drivers/cdrom/cdrom.c CVE-2018-13405 — kernel: Missing check in fs/inode.c:inode_init_owner() does not clear SGID bit on non-directories for non-members CVE-2018-18690 — kernel: filesystem corruption due to an unchecked error condition during an xfs attribute change CVE-2018-1000026 — kernel: Improper validation in bnx2x network card driver can allow for denial of service attacks via crafted packet

🎯 Affected products200

  • Red Hat Enterprise Linux Client (v. 7)
  • Red Hat Enterprise Linux Client Optional (v. 7)
  • Red Hat Enterprise Linux ComputeNode (v. 7)
  • Red Hat Enterprise Linux ComputeNode Optional (v. 7)
  • Red Hat Enterprise Linux Server (v. 7)
  • Red Hat Enterprise Linux Server Optional (v. 7)
  • Red Hat Enterprise Linux Workstation (v. 7)
  • Red Hat Enterprise Linux Workstation Optional (v. 7)
  • Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)
  • Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)
  • bpftool-0:3.10.0-957.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)
  • bpftool-0:3.10.0-957.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)
  • bpftool-0:3.10.0-957.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)
  • bpftool-0:3.10.0-957.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)
  • kernel-0:3.10.0-957.el7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)
  • kernel-0:3.10.0-957.el7.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)
  • kernel-0:3.10.0-957.el7.ppc64le as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)
  • kernel-0:3.10.0-957.el7.s390x as a component of Red Hat Enterprise Linux Server (v. 7)
  • kernel-0:3.10.0-957.el7.s390x as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)
  • kernel-0:3.10.0-957.el7.src as a component of Red Hat Enterprise Linux Client (v. 7)
  • kernel-0:3.10.0-957.el7.src as a component of Red Hat Enterprise Linux ComputeNode (v. 7)
  • kernel-0:3.10.0-957.el7.src as a component of Red Hat Enterprise Linux Server (v. 7)
  • kernel-0:3.10.0-957.el7.src as a component of Red Hat Enterprise Linux Workstation (v. 7)
  • kernel-0:3.10.0-957.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)
  • kernel-0:3.10.0-957.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)
  • kernel-0:3.10.0-957.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)
  • kernel-0:3.10.0-957.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)
  • kernel-abi-whitelists-0:3.10.0-957.el7.noarch as a component of Red Hat Enterprise Linux Client (v. 7)
  • kernel-abi-whitelists-0:3.10.0-957.el7.noarch as a component of Red Hat Enterprise Linux ComputeNode (v. 7)
  • kernel-abi-whitelists-0:3.10.0-957.el7.noarch as a component of Red Hat Enterprise Linux Server (v. 7)
  • +170 more not shown

✅ Remediation

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Workaround: Attached to this bugzilla is a systemtap script that will prevent opening (and therefore reading) the /proc/<process>/timers file which is used to leak information. The SystemTap script is relatively small and efficient, broken into 3 distinct sections as follows: -------- probe kernel.function("proc_timers_open@fs/proc/base.c").return { // this is -EACCES $return = -13; message = sprintf("CVE-2017-18344 mitigation denied access to %s to %s(%d)", file_name , execname(), pid()); // print a warning message at KERN_INFO debug level printk(6, message); } probe begin { printk(6, "Mitigation for CVE-2017-18344 loaded.\n"); } probe end { printk(6, "Mitigation for CVE-2017-18344 unloaded.\n"); } --------- First, the script places a probe at the return of the kernel function “proc_timers_open” when called. This modifies the return value to be EACCES which would return this value to userspace preventing this file from being opened. When the /proc/<pid>/timer file is attempted to be opened, a message will be logged to the kernel log subsystem showing the process and pid of the application attempting to access the timer file. This file is not in widespread use at this time, although some applications may read from it to debug or understand their own timers that are set. This mitigation will not be useful in this context. Finally, the “probe begin” and “probe end” code blocks tell systemtap to add the supplied text to the kernel log buffer via the printk function. This creates an audit trail by registering in the system logs exactly when the mitigation is loaded and unloaded. This will need to be compiled with guru mode (-g parameter) to compile. This will need to be loaded at each boot to remain effective. Red Hat Product security recommends updating to a patched kernel when it is available. Red Hat always seeks to provide both mitigations to disable attacks as well as the actual patches to treat the flaw. To learn more about SystemTap, and how it can be used in your management of your Red Hat systems, please refer to Using SystemTap[1] or one of our videos about it within our Customer Portal[2]. 1 - https://access.redhat.com/articles/17839 2 - https://access.redhat.com/search/#/?q=systemtap Workaround: One may change the default 4MB and 3MB values of net.ipv4.ipfrag_high_thresh and net.ipv4.ipfrag_low_thresh (and their ipv6 counterparts net.ipv6.ipfrag_high_thresh and net.ipv6.ipfrag_low_thresh) to 256 kB and 192 kB (respectively) or below. Tests show some to significant CPU saturation drop during an attack, depending on a hardware, configuration and environment. There can be some impact on performance though, due to ipfrag_high_thresh of 262144 bytes, as only two 64K fragments can fit in the reassembly queue at the same time. For example, there is a risk of breaking applications that rely on large UDP packets. See the Mitigation section in the https://access.redhat.com/articles/3553061 article for the script to quickly change to/from default and lower settings.

🔗 References (50)