Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2018.0268 Important: kernel security and bug fix update 29 January 2018 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: kernel Publisher: Red Hat Operating System: Red Hat Impact/Access: Root Compromise -- Existing Account Access Privileged Data -- Existing Account Denial of Service -- Existing Account Resolution: Patch/Upgrade CVE Names: CVE-2017-15649 CVE-2017-12193 CVE-2017-12192 CVE-2017-11176 CVE-2017-9074 CVE-2017-7542 CVE-2017-7472 CVE-2017-5754 CVE-2017-5753 CVE-2017-5715 CVE-2015-8539 Reference: ASB-2018.0033 ASB-2018.0030 ASB-2018.0009 ASB-2018.0002.4 ESB-2016.1971 ESB-2016.1874 ESB-2016.1078 ESB-2016.0821 Original Bulletin: https://access.redhat.com/errata/RHSA-2018:0151 https://access.redhat.com/errata/RHSA-2018:0169 https://access.redhat.com/errata/RHSA-2018:0182 Comment: This bulletin contains three (3) Red Hat security advisories. - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: kernel security and bug fix update Advisory ID: RHSA-2018:0151-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2018:0151 Issue date: 2018-01-25 CVE Names: CVE-2015-8539 CVE-2017-7472 CVE-2017-12192 CVE-2017-12193 CVE-2017-15649 ===================================================================== 1. Summary: An update for kernel is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client (v. 7) - noarch, x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode (v. 7) - noarch, x86_64 Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64 Red Hat Enterprise Linux Server (v. 7) - noarch, ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64 3. Description: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions (a commonly used performance optimization). There are three primary variants of the issue which differ in the way the speculative execution can be exploited. Note: This issue is present in hardware and cannot be fully fixed via software update. The updated kernel packages provide software mitigation for this hardware issue at a cost of potential performance penalty. Please refer to References section for further information about this issue and the performance impact. In this update initial mitigations for IBM Power (PowerPC) and IBM zSeries (S390) architectures are provided. * Variant CVE-2017-5715 triggers the speculative execution by utilizing branch target injection. It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory accesses may cause allocation into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to cross the syscall and guest/host boundaries and read privileged memory by conducting targeted cache side-channel attacks. This fix specifically addresses S390 processors. (CVE-2017-5715, Important) * Variant CVE-2017-5753 triggers the speculative execution by performing a bounds-check bypass. It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory accesses may cause allocation into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to cross the syscall boundary and read privileged memory by conducting targeted cache side-channel attacks. This fix specifically addresses S390 and PowerPC processors. (CVE-2017-5753, Important) * Variant CVE-2017-5754 relies on the fact that, on impacted microprocessors, during speculative execution of instruction permission faults, exception generation triggered by a faulting access is suppressed until the retirement of the whole instruction block. In a combination with the fact that memory accesses may populate the cache even when the block is being dropped and never committed (executed), an unprivileged local attacker could use this flaw to read privileged (kernel space) memory by conducting targeted cache side-channel attacks. Note: CVE-2017-5754 affects Intel x86-64 microprocessors. AMD x86-64 microprocessors are not affected by this issue. This fix specifically addresses PowerPC processors. (CVE-2017-5754, Important) Red Hat would like to thank Google Project Zero for reporting CVE-2017-5715, CVE-2017-5753, and CVE-2017-5754. This update also fixes the following security issues and bugs: Space precludes documenting all of the bug fixes and enhancements included in this advisory. To see the complete list of bug fixes and enhancements, refer to the following KnowledgeBase article: https://access.redhat.com/articles/3327131. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 1284450 - CVE-2015-8539 kernel: local privesc in key management 1442086 - CVE-2017-7472 kernel: keyctl_set_reqkey_keyring() leaks thread keyrings 1493435 - CVE-2017-12192 kernel: NULL pointer dereference due to KEYCTL_READ on negative key 1501215 - CVE-2017-12193 kernel: Null pointer dereference due to incorrect node-splitting in assoc_array implementation 1504574 - CVE-2017-15649 kernel: Use-after-free in the af_packet.c 1519778 - CVE-2017-5753 hw: cpu: speculative execution bounds-check bypass 1519780 - CVE-2017-5715 hw: cpu: speculative execution branch target injection 1519781 - CVE-2017-5754 hw: cpu: speculative execution permission faults handling 6. Package List: Red Hat Enterprise Linux Client (v. 7): Source: kernel-3.10.0-693.17.1.el7.src.rpm noarch: kernel-abi-whitelists-3.10.0-693.17.1.el7.noarch.rpm kernel-doc-3.10.0-693.17.1.el7.noarch.rpm x86_64: kernel-3.10.0-693.17.1.el7.x86_64.rpm kernel-debug-3.10.0-693.17.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-693.17.1.el7.x86_64.rpm kernel-debug-devel-3.10.0-693.17.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-693.17.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-693.17.1.el7.x86_64.rpm kernel-devel-3.10.0-693.17.1.el7.x86_64.rpm kernel-headers-3.10.0-693.17.1.el7.x86_64.rpm kernel-tools-3.10.0-693.17.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-693.17.1.el7.x86_64.rpm kernel-tools-libs-3.10.0-693.17.1.el7.x86_64.rpm perf-3.10.0-693.17.1.el7.x86_64.rpm perf-debuginfo-3.10.0-693.17.1.el7.x86_64.rpm python-perf-3.10.0-693.17.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-693.17.1.el7.x86_64.rpm Red Hat Enterprise Linux Client Optional (v. 7): x86_64: kernel-debug-debuginfo-3.10.0-693.17.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-693.17.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-693.17.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-693.17.1.el7.x86_64.rpm kernel-tools-libs-devel-3.10.0-693.17.1.el7.x86_64.rpm perf-debuginfo-3.10.0-693.17.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-693.17.1.el7.x86_64.rpm Red Hat Enterprise Linux ComputeNode (v. 7): Source: kernel-3.10.0-693.17.1.el7.src.rpm noarch: kernel-abi-whitelists-3.10.0-693.17.1.el7.noarch.rpm kernel-doc-3.10.0-693.17.1.el7.noarch.rpm x86_64: kernel-3.10.0-693.17.1.el7.x86_64.rpm kernel-debug-3.10.0-693.17.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-693.17.1.el7.x86_64.rpm kernel-debug-devel-3.10.0-693.17.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-693.17.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-693.17.1.el7.x86_64.rpm kernel-devel-3.10.0-693.17.1.el7.x86_64.rpm kernel-headers-3.10.0-693.17.1.el7.x86_64.rpm kernel-tools-3.10.0-693.17.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-693.17.1.el7.x86_64.rpm kernel-tools-libs-3.10.0-693.17.1.el7.x86_64.rpm perf-3.10.0-693.17.1.el7.x86_64.rpm perf-debuginfo-3.10.0-693.17.1.el7.x86_64.rpm python-perf-3.10.0-693.17.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-693.17.1.el7.x86_64.rpm Red Hat Enterprise Linux ComputeNode Optional (v. 7): x86_64: kernel-debug-debuginfo-3.10.0-693.17.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-693.17.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-693.17.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-693.17.1.el7.x86_64.rpm kernel-tools-libs-devel-3.10.0-693.17.1.el7.x86_64.rpm perf-debuginfo-3.10.0-693.17.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-693.17.1.el7.x86_64.rpm Red Hat Enterprise Linux Server (v. 7): Source: kernel-3.10.0-693.17.1.el7.src.rpm noarch: kernel-abi-whitelists-3.10.0-693.17.1.el7.noarch.rpm kernel-doc-3.10.0-693.17.1.el7.noarch.rpm ppc64: kernel-3.10.0-693.17.1.el7.ppc64.rpm kernel-bootwrapper-3.10.0-693.17.1.el7.ppc64.rpm kernel-debug-3.10.0-693.17.1.el7.ppc64.rpm kernel-debug-debuginfo-3.10.0-693.17.1.el7.ppc64.rpm kernel-debug-devel-3.10.0-693.17.1.el7.ppc64.rpm kernel-debuginfo-3.10.0-693.17.1.el7.ppc64.rpm kernel-debuginfo-common-ppc64-3.10.0-693.17.1.el7.ppc64.rpm kernel-devel-3.10.0-693.17.1.el7.ppc64.rpm kernel-headers-3.10.0-693.17.1.el7.ppc64.rpm kernel-tools-3.10.0-693.17.1.el7.ppc64.rpm kernel-tools-debuginfo-3.10.0-693.17.1.el7.ppc64.rpm kernel-tools-libs-3.10.0-693.17.1.el7.ppc64.rpm perf-3.10.0-693.17.1.el7.ppc64.rpm perf-debuginfo-3.10.0-693.17.1.el7.ppc64.rpm python-perf-3.10.0-693.17.1.el7.ppc64.rpm python-perf-debuginfo-3.10.0-693.17.1.el7.ppc64.rpm ppc64le: kernel-3.10.0-693.17.1.el7.ppc64le.rpm kernel-bootwrapper-3.10.0-693.17.1.el7.ppc64le.rpm kernel-debug-3.10.0-693.17.1.el7.ppc64le.rpm kernel-debug-debuginfo-3.10.0-693.17.1.el7.ppc64le.rpm kernel-debuginfo-3.10.0-693.17.1.el7.ppc64le.rpm kernel-debuginfo-common-ppc64le-3.10.0-693.17.1.el7.ppc64le.rpm kernel-devel-3.10.0-693.17.1.el7.ppc64le.rpm kernel-headers-3.10.0-693.17.1.el7.ppc64le.rpm kernel-tools-3.10.0-693.17.1.el7.ppc64le.rpm kernel-tools-debuginfo-3.10.0-693.17.1.el7.ppc64le.rpm kernel-tools-libs-3.10.0-693.17.1.el7.ppc64le.rpm perf-3.10.0-693.17.1.el7.ppc64le.rpm perf-debuginfo-3.10.0-693.17.1.el7.ppc64le.rpm python-perf-3.10.0-693.17.1.el7.ppc64le.rpm python-perf-debuginfo-3.10.0-693.17.1.el7.ppc64le.rpm s390x: kernel-3.10.0-693.17.1.el7.s390x.rpm kernel-debug-3.10.0-693.17.1.el7.s390x.rpm kernel-debug-debuginfo-3.10.0-693.17.1.el7.s390x.rpm kernel-debug-devel-3.10.0-693.17.1.el7.s390x.rpm kernel-debuginfo-3.10.0-693.17.1.el7.s390x.rpm kernel-debuginfo-common-s390x-3.10.0-693.17.1.el7.s390x.rpm kernel-devel-3.10.0-693.17.1.el7.s390x.rpm kernel-headers-3.10.0-693.17.1.el7.s390x.rpm kernel-kdump-3.10.0-693.17.1.el7.s390x.rpm kernel-kdump-debuginfo-3.10.0-693.17.1.el7.s390x.rpm kernel-kdump-devel-3.10.0-693.17.1.el7.s390x.rpm perf-3.10.0-693.17.1.el7.s390x.rpm perf-debuginfo-3.10.0-693.17.1.el7.s390x.rpm python-perf-3.10.0-693.17.1.el7.s390x.rpm python-perf-debuginfo-3.10.0-693.17.1.el7.s390x.rpm x86_64: kernel-3.10.0-693.17.1.el7.x86_64.rpm kernel-debug-3.10.0-693.17.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-693.17.1.el7.x86_64.rpm kernel-debug-devel-3.10.0-693.17.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-693.17.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-693.17.1.el7.x86_64.rpm kernel-devel-3.10.0-693.17.1.el7.x86_64.rpm kernel-headers-3.10.0-693.17.1.el7.x86_64.rpm kernel-tools-3.10.0-693.17.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-693.17.1.el7.x86_64.rpm kernel-tools-libs-3.10.0-693.17.1.el7.x86_64.rpm perf-3.10.0-693.17.1.el7.x86_64.rpm perf-debuginfo-3.10.0-693.17.1.el7.x86_64.rpm python-perf-3.10.0-693.17.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-693.17.1.el7.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 7): ppc64: kernel-debug-debuginfo-3.10.0-693.17.1.el7.ppc64.rpm kernel-debuginfo-3.10.0-693.17.1.el7.ppc64.rpm kernel-debuginfo-common-ppc64-3.10.0-693.17.1.el7.ppc64.rpm kernel-tools-debuginfo-3.10.0-693.17.1.el7.ppc64.rpm kernel-tools-libs-devel-3.10.0-693.17.1.el7.ppc64.rpm perf-debuginfo-3.10.0-693.17.1.el7.ppc64.rpm python-perf-debuginfo-3.10.0-693.17.1.el7.ppc64.rpm ppc64le: kernel-debug-debuginfo-3.10.0-693.17.1.el7.ppc64le.rpm kernel-debug-devel-3.10.0-693.17.1.el7.ppc64le.rpm kernel-debuginfo-3.10.0-693.17.1.el7.ppc64le.rpm kernel-debuginfo-common-ppc64le-3.10.0-693.17.1.el7.ppc64le.rpm kernel-tools-debuginfo-3.10.0-693.17.1.el7.ppc64le.rpm kernel-tools-libs-devel-3.10.0-693.17.1.el7.ppc64le.rpm perf-debuginfo-3.10.0-693.17.1.el7.ppc64le.rpm python-perf-debuginfo-3.10.0-693.17.1.el7.ppc64le.rpm x86_64: kernel-debug-debuginfo-3.10.0-693.17.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-693.17.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-693.17.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-693.17.1.el7.x86_64.rpm kernel-tools-libs-devel-3.10.0-693.17.1.el7.x86_64.rpm perf-debuginfo-3.10.0-693.17.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-693.17.1.el7.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: kernel-3.10.0-693.17.1.el7.src.rpm noarch: kernel-abi-whitelists-3.10.0-693.17.1.el7.noarch.rpm kernel-doc-3.10.0-693.17.1.el7.noarch.rpm x86_64: kernel-3.10.0-693.17.1.el7.x86_64.rpm kernel-debug-3.10.0-693.17.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-693.17.1.el7.x86_64.rpm kernel-debug-devel-3.10.0-693.17.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-693.17.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-693.17.1.el7.x86_64.rpm kernel-devel-3.10.0-693.17.1.el7.x86_64.rpm kernel-headers-3.10.0-693.17.1.el7.x86_64.rpm kernel-tools-3.10.0-693.17.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-693.17.1.el7.x86_64.rpm kernel-tools-libs-3.10.0-693.17.1.el7.x86_64.rpm perf-3.10.0-693.17.1.el7.x86_64.rpm perf-debuginfo-3.10.0-693.17.1.el7.x86_64.rpm python-perf-3.10.0-693.17.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-693.17.1.el7.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 7): x86_64: kernel-debug-debuginfo-3.10.0-693.17.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-693.17.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-693.17.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-693.17.1.el7.x86_64.rpm kernel-tools-libs-devel-3.10.0-693.17.1.el7.x86_64.rpm perf-debuginfo-3.10.0-693.17.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-693.17.1.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-8539 https://access.redhat.com/security/cve/CVE-2017-7472 https://access.redhat.com/security/cve/CVE-2017-12192 https://access.redhat.com/security/cve/CVE-2017-12193 https://access.redhat.com/security/cve/CVE-2017-15649 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/security/vulnerabilities/speculativeexecution https://access.redhat.com/security/cve/CVE-2017-5753 https://access.redhat.com/security/cve/CVE-2017-5715 https://access.redhat.com/security/cve/CVE-2017-5754 https://access.redhat.com/articles/3327131 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2018 Red Hat, Inc. - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFaab47XlSAg2UNWIIRAgi2AKDDW6z/9di3aoNQMX6PaIOzYTu39gCgncrF n+VQu/CVEmiUW8aXZCnplaM= =Km2i - -----END PGP SIGNATURE----- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: kernel security and bug fix update Advisory ID: RHSA-2018:0169-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2018:0169 Issue date: 2018-01-25 CVE Names: CVE-2017-7542 CVE-2017-9074 CVE-2017-11176 ===================================================================== 1. Summary: An update for kernel is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 6) - i386, noarch, x86_64 Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux HPC Node (v. 6) - noarch, x86_64 Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, noarch, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, noarch, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64 3. Description: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * An integer overflow vulnerability in ip6_find_1stfragopt() function was found. A local attacker that has privileges (of CAP_NET_RAW) to open raw socket can cause an infinite loop inside the ip6_find_1stfragopt() function. (CVE-2017-7542, Moderate) * The IPv6 fragmentation implementation in the Linux kernel does not consider that the nexthdr field may be associated with an invalid option, which allows local users to cause a denial of service (out-of-bounds read and BUG) or possibly have unspecified other impact via crafted socket and send system calls. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely. (CVE-2017-9074, Moderate) * A use-after-free flaw was found in the Netlink functionality of the Linux kernel networking subsystem. Due to the insufficient cleanup in the mq_notify function, a local attacker could potentially use this flaw to escalate their privileges on the system. (CVE-2017-11176, Moderate) Bug Fix(es): * Previously, the default timeout and retry settings in the VMBus driver were insufficient in some cases, for example when a Hyper-V host was under a significant load. Consequently, in Windows Server 2016, Hyper-V Server 2016, and Windows Azure Platform, when running a Red Hat Enterprise Linux Guest on the Hyper-V hypervisor, the guest failed to boot or booted with certain Hyper-V devices missing. This update alters the timeout and retry settings in VMBus, and Red Hat Enterprise Linux guests now boot as expected under the described conditions. (BZ#1506145) * Previously, an incorrect external declaration in the be2iscsi driver caused a kernel panic when using the systool utility. With this update, the external declaration in be2iscsi has been fixed, and the kernel no longer panics when using systool. (BZ#1507512) * Under high usage of the NFSD file system and memory pressure, if many tasks in the Linux kernel attempted to obtain the global spinlock to clean the Duplicate Reply Cache (DRC), these tasks stayed in an active wait in the nfsd_reply_cache_shrink() function for up to 99% of time. Consequently, a high load average occurred. This update fixes the bug by separating the DRC in several parts, each with an independent spinlock. As a result, the load and CPU utilization is no longer excessive under the described circumstances. (BZ#1509876) * When attempting to attach multiple SCSI devices simultaneously, Red Hat Enterprise Linux 6.9 on IBM z Systems sometimes became unresponsive. This update fixes the zfcp device driver, and attaching multiple SCSI devices simultaneously now works as expected in the described scenario. (BZ#1512425) * On IBM z Systems, the tiqdio_call_inq_handlers() function in the Linux kernel incorrectly cleared the device state change indicator (DSCI) for the af_iucv devices using the HiperSockets transport with multiple input queues. Consequently, queue stalls on such devices occasionally occurred. With this update, tiqdio_call_inq_handlers() has been fixed to clear the DSCI only once, prior to scanning the queues. As a result, queue stalls for af_iucv devices using the HiperSockets transport no longer occur under the described circumstances. (BZ#1513314) * Previously, small data chunks caused the Stream Control Transmission Protocol (SCTP) to account the receiver_window (rwnd) values incorrectly when recovering from a "zero-window situation". As a consequence, window updates were not sent to the peer, and an artificial growth of rwnd could lead to packet drops. This update properly accounts such small data chunks and ignores the rwnd pressure values when reopening a window. As a result, window updates are now sent, and the announced rwnd reflects better the real state of the receive buffer. (BZ#1514443) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 1452679 - CVE-2017-9074 kernel: net: IPv6 fragmentation implementation of nexthdr field may be associated with an invalid option 1470659 - CVE-2017-11176 kernel: Use-after-free in sys_mq_notify() 1473649 - CVE-2017-7542 kernel: Integer overflow in ip6_find_1stfragopt() causes infinite loop 6. Package List: Red Hat Enterprise Linux Desktop (v. 6): Source: kernel-2.6.32-696.20.1.el6.src.rpm i386: kernel-2.6.32-696.20.1.el6.i686.rpm kernel-debug-2.6.32-696.20.1.el6.i686.rpm kernel-debug-debuginfo-2.6.32-696.20.1.el6.i686.rpm kernel-debug-devel-2.6.32-696.20.1.el6.i686.rpm kernel-debuginfo-2.6.32-696.20.1.el6.i686.rpm kernel-debuginfo-common-i686-2.6.32-696.20.1.el6.i686.rpm kernel-devel-2.6.32-696.20.1.el6.i686.rpm kernel-headers-2.6.32-696.20.1.el6.i686.rpm perf-2.6.32-696.20.1.el6.i686.rpm perf-debuginfo-2.6.32-696.20.1.el6.i686.rpm python-perf-debuginfo-2.6.32-696.20.1.el6.i686.rpm noarch: kernel-abi-whitelists-2.6.32-696.20.1.el6.noarch.rpm kernel-doc-2.6.32-696.20.1.el6.noarch.rpm kernel-firmware-2.6.32-696.20.1.el6.noarch.rpm x86_64: kernel-2.6.32-696.20.1.el6.x86_64.rpm kernel-debug-2.6.32-696.20.1.el6.x86_64.rpm kernel-debug-debuginfo-2.6.32-696.20.1.el6.i686.rpm kernel-debug-debuginfo-2.6.32-696.20.1.el6.x86_64.rpm kernel-debug-devel-2.6.32-696.20.1.el6.i686.rpm kernel-debug-devel-2.6.32-696.20.1.el6.x86_64.rpm kernel-debuginfo-2.6.32-696.20.1.el6.i686.rpm kernel-debuginfo-2.6.32-696.20.1.el6.x86_64.rpm kernel-debuginfo-common-i686-2.6.32-696.20.1.el6.i686.rpm kernel-debuginfo-common-x86_64-2.6.32-696.20.1.el6.x86_64.rpm kernel-devel-2.6.32-696.20.1.el6.x86_64.rpm kernel-headers-2.6.32-696.20.1.el6.x86_64.rpm perf-2.6.32-696.20.1.el6.x86_64.rpm perf-debuginfo-2.6.32-696.20.1.el6.i686.rpm perf-debuginfo-2.6.32-696.20.1.el6.x86_64.rpm python-perf-debuginfo-2.6.32-696.20.1.el6.i686.rpm python-perf-debuginfo-2.6.32-696.20.1.el6.x86_64.rpm Red Hat Enterprise Linux Desktop Optional (v. 6): i386: kernel-debug-debuginfo-2.6.32-696.20.1.el6.i686.rpm kernel-debuginfo-2.6.32-696.20.1.el6.i686.rpm kernel-debuginfo-common-i686-2.6.32-696.20.1.el6.i686.rpm perf-debuginfo-2.6.32-696.20.1.el6.i686.rpm python-perf-2.6.32-696.20.1.el6.i686.rpm python-perf-debuginfo-2.6.32-696.20.1.el6.i686.rpm x86_64: kernel-debug-debuginfo-2.6.32-696.20.1.el6.x86_64.rpm kernel-debuginfo-2.6.32-696.20.1.el6.x86_64.rpm kernel-debuginfo-common-x86_64-2.6.32-696.20.1.el6.x86_64.rpm perf-debuginfo-2.6.32-696.20.1.el6.x86_64.rpm python-perf-2.6.32-696.20.1.el6.x86_64.rpm python-perf-debuginfo-2.6.32-696.20.1.el6.x86_64.rpm Red Hat Enterprise Linux HPC Node (v. 6): Source: kernel-2.6.32-696.20.1.el6.src.rpm noarch: kernel-abi-whitelists-2.6.32-696.20.1.el6.noarch.rpm kernel-doc-2.6.32-696.20.1.el6.noarch.rpm kernel-firmware-2.6.32-696.20.1.el6.noarch.rpm x86_64: kernel-2.6.32-696.20.1.el6.x86_64.rpm kernel-debug-2.6.32-696.20.1.el6.x86_64.rpm kernel-debug-debuginfo-2.6.32-696.20.1.el6.i686.rpm kernel-debug-debuginfo-2.6.32-696.20.1.el6.x86_64.rpm kernel-debug-devel-2.6.32-696.20.1.el6.i686.rpm kernel-debug-devel-2.6.32-696.20.1.el6.x86_64.rpm kernel-debuginfo-2.6.32-696.20.1.el6.i686.rpm kernel-debuginfo-2.6.32-696.20.1.el6.x86_64.rpm kernel-debuginfo-common-i686-2.6.32-696.20.1.el6.i686.rpm kernel-debuginfo-common-x86_64-2.6.32-696.20.1.el6.x86_64.rpm kernel-devel-2.6.32-696.20.1.el6.x86_64.rpm kernel-headers-2.6.32-696.20.1.el6.x86_64.rpm perf-2.6.32-696.20.1.el6.x86_64.rpm perf-debuginfo-2.6.32-696.20.1.el6.i686.rpm perf-debuginfo-2.6.32-696.20.1.el6.x86_64.rpm python-perf-debuginfo-2.6.32-696.20.1.el6.i686.rpm python-perf-debuginfo-2.6.32-696.20.1.el6.x86_64.rpm Red Hat Enterprise Linux HPC Node Optional (v. 6): x86_64: kernel-debug-debuginfo-2.6.32-696.20.1.el6.x86_64.rpm kernel-debuginfo-2.6.32-696.20.1.el6.x86_64.rpm kernel-debuginfo-common-x86_64-2.6.32-696.20.1.el6.x86_64.rpm perf-debuginfo-2.6.32-696.20.1.el6.x86_64.rpm python-perf-2.6.32-696.20.1.el6.x86_64.rpm python-perf-debuginfo-2.6.32-696.20.1.el6.x86_64.rpm Red Hat Enterprise Linux Server (v. 6): Source: kernel-2.6.32-696.20.1.el6.src.rpm i386: kernel-2.6.32-696.20.1.el6.i686.rpm kernel-debug-2.6.32-696.20.1.el6.i686.rpm kernel-debug-debuginfo-2.6.32-696.20.1.el6.i686.rpm kernel-debug-devel-2.6.32-696.20.1.el6.i686.rpm kernel-debuginfo-2.6.32-696.20.1.el6.i686.rpm kernel-debuginfo-common-i686-2.6.32-696.20.1.el6.i686.rpm kernel-devel-2.6.32-696.20.1.el6.i686.rpm kernel-headers-2.6.32-696.20.1.el6.i686.rpm perf-2.6.32-696.20.1.el6.i686.rpm perf-debuginfo-2.6.32-696.20.1.el6.i686.rpm python-perf-debuginfo-2.6.32-696.20.1.el6.i686.rpm noarch: kernel-abi-whitelists-2.6.32-696.20.1.el6.noarch.rpm kernel-doc-2.6.32-696.20.1.el6.noarch.rpm kernel-firmware-2.6.32-696.20.1.el6.noarch.rpm ppc64: kernel-2.6.32-696.20.1.el6.ppc64.rpm kernel-bootwrapper-2.6.32-696.20.1.el6.ppc64.rpm kernel-debug-2.6.32-696.20.1.el6.ppc64.rpm kernel-debug-debuginfo-2.6.32-696.20.1.el6.ppc64.rpm kernel-debug-devel-2.6.32-696.20.1.el6.ppc64.rpm kernel-debuginfo-2.6.32-696.20.1.el6.ppc64.rpm kernel-debuginfo-common-ppc64-2.6.32-696.20.1.el6.ppc64.rpm kernel-devel-2.6.32-696.20.1.el6.ppc64.rpm kernel-headers-2.6.32-696.20.1.el6.ppc64.rpm perf-2.6.32-696.20.1.el6.ppc64.rpm perf-debuginfo-2.6.32-696.20.1.el6.ppc64.rpm python-perf-debuginfo-2.6.32-696.20.1.el6.ppc64.rpm s390x: kernel-2.6.32-696.20.1.el6.s390x.rpm kernel-debug-2.6.32-696.20.1.el6.s390x.rpm kernel-debug-debuginfo-2.6.32-696.20.1.el6.s390x.rpm kernel-debug-devel-2.6.32-696.20.1.el6.s390x.rpm kernel-debuginfo-2.6.32-696.20.1.el6.s390x.rpm kernel-debuginfo-common-s390x-2.6.32-696.20.1.el6.s390x.rpm kernel-devel-2.6.32-696.20.1.el6.s390x.rpm kernel-headers-2.6.32-696.20.1.el6.s390x.rpm kernel-kdump-2.6.32-696.20.1.el6.s390x.rpm kernel-kdump-debuginfo-2.6.32-696.20.1.el6.s390x.rpm kernel-kdump-devel-2.6.32-696.20.1.el6.s390x.rpm perf-2.6.32-696.20.1.el6.s390x.rpm perf-debuginfo-2.6.32-696.20.1.el6.s390x.rpm python-perf-debuginfo-2.6.32-696.20.1.el6.s390x.rpm x86_64: kernel-2.6.32-696.20.1.el6.x86_64.rpm kernel-debug-2.6.32-696.20.1.el6.x86_64.rpm kernel-debug-debuginfo-2.6.32-696.20.1.el6.i686.rpm kernel-debug-debuginfo-2.6.32-696.20.1.el6.x86_64.rpm kernel-debug-devel-2.6.32-696.20.1.el6.i686.rpm kernel-debug-devel-2.6.32-696.20.1.el6.x86_64.rpm kernel-debuginfo-2.6.32-696.20.1.el6.i686.rpm kernel-debuginfo-2.6.32-696.20.1.el6.x86_64.rpm kernel-debuginfo-common-i686-2.6.32-696.20.1.el6.i686.rpm kernel-debuginfo-common-x86_64-2.6.32-696.20.1.el6.x86_64.rpm kernel-devel-2.6.32-696.20.1.el6.x86_64.rpm kernel-headers-2.6.32-696.20.1.el6.x86_64.rpm perf-2.6.32-696.20.1.el6.x86_64.rpm perf-debuginfo-2.6.32-696.20.1.el6.i686.rpm perf-debuginfo-2.6.32-696.20.1.el6.x86_64.rpm python-perf-debuginfo-2.6.32-696.20.1.el6.i686.rpm python-perf-debuginfo-2.6.32-696.20.1.el6.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 6): i386: kernel-debug-debuginfo-2.6.32-696.20.1.el6.i686.rpm kernel-debuginfo-2.6.32-696.20.1.el6.i686.rpm kernel-debuginfo-common-i686-2.6.32-696.20.1.el6.i686.rpm perf-debuginfo-2.6.32-696.20.1.el6.i686.rpm python-perf-2.6.32-696.20.1.el6.i686.rpm python-perf-debuginfo-2.6.32-696.20.1.el6.i686.rpm ppc64: kernel-debug-debuginfo-2.6.32-696.20.1.el6.ppc64.rpm kernel-debuginfo-2.6.32-696.20.1.el6.ppc64.rpm kernel-debuginfo-common-ppc64-2.6.32-696.20.1.el6.ppc64.rpm perf-debuginfo-2.6.32-696.20.1.el6.ppc64.rpm python-perf-2.6.32-696.20.1.el6.ppc64.rpm python-perf-debuginfo-2.6.32-696.20.1.el6.ppc64.rpm s390x: kernel-debug-debuginfo-2.6.32-696.20.1.el6.s390x.rpm kernel-debuginfo-2.6.32-696.20.1.el6.s390x.rpm kernel-debuginfo-common-s390x-2.6.32-696.20.1.el6.s390x.rpm kernel-kdump-debuginfo-2.6.32-696.20.1.el6.s390x.rpm perf-debuginfo-2.6.32-696.20.1.el6.s390x.rpm python-perf-2.6.32-696.20.1.el6.s390x.rpm python-perf-debuginfo-2.6.32-696.20.1.el6.s390x.rpm x86_64: kernel-debug-debuginfo-2.6.32-696.20.1.el6.x86_64.rpm kernel-debuginfo-2.6.32-696.20.1.el6.x86_64.rpm kernel-debuginfo-common-x86_64-2.6.32-696.20.1.el6.x86_64.rpm perf-debuginfo-2.6.32-696.20.1.el6.x86_64.rpm python-perf-2.6.32-696.20.1.el6.x86_64.rpm python-perf-debuginfo-2.6.32-696.20.1.el6.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 6): Source: kernel-2.6.32-696.20.1.el6.src.rpm i386: kernel-2.6.32-696.20.1.el6.i686.rpm kernel-debug-2.6.32-696.20.1.el6.i686.rpm kernel-debug-debuginfo-2.6.32-696.20.1.el6.i686.rpm kernel-debug-devel-2.6.32-696.20.1.el6.i686.rpm kernel-debuginfo-2.6.32-696.20.1.el6.i686.rpm kernel-debuginfo-common-i686-2.6.32-696.20.1.el6.i686.rpm kernel-devel-2.6.32-696.20.1.el6.i686.rpm kernel-headers-2.6.32-696.20.1.el6.i686.rpm perf-2.6.32-696.20.1.el6.i686.rpm perf-debuginfo-2.6.32-696.20.1.el6.i686.rpm python-perf-debuginfo-2.6.32-696.20.1.el6.i686.rpm noarch: kernel-abi-whitelists-2.6.32-696.20.1.el6.noarch.rpm kernel-doc-2.6.32-696.20.1.el6.noarch.rpm kernel-firmware-2.6.32-696.20.1.el6.noarch.rpm x86_64: kernel-2.6.32-696.20.1.el6.x86_64.rpm kernel-debug-2.6.32-696.20.1.el6.x86_64.rpm kernel-debug-debuginfo-2.6.32-696.20.1.el6.i686.rpm kernel-debug-debuginfo-2.6.32-696.20.1.el6.x86_64.rpm kernel-debug-devel-2.6.32-696.20.1.el6.i686.rpm kernel-debug-devel-2.6.32-696.20.1.el6.x86_64.rpm kernel-debuginfo-2.6.32-696.20.1.el6.i686.rpm kernel-debuginfo-2.6.32-696.20.1.el6.x86_64.rpm kernel-debuginfo-common-i686-2.6.32-696.20.1.el6.i686.rpm kernel-debuginfo-common-x86_64-2.6.32-696.20.1.el6.x86_64.rpm kernel-devel-2.6.32-696.20.1.el6.x86_64.rpm kernel-headers-2.6.32-696.20.1.el6.x86_64.rpm perf-2.6.32-696.20.1.el6.x86_64.rpm perf-debuginfo-2.6.32-696.20.1.el6.i686.rpm perf-debuginfo-2.6.32-696.20.1.el6.x86_64.rpm python-perf-debuginfo-2.6.32-696.20.1.el6.i686.rpm python-perf-debuginfo-2.6.32-696.20.1.el6.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 6): i386: kernel-debug-debuginfo-2.6.32-696.20.1.el6.i686.rpm kernel-debuginfo-2.6.32-696.20.1.el6.i686.rpm kernel-debuginfo-common-i686-2.6.32-696.20.1.el6.i686.rpm perf-debuginfo-2.6.32-696.20.1.el6.i686.rpm python-perf-2.6.32-696.20.1.el6.i686.rpm python-perf-debuginfo-2.6.32-696.20.1.el6.i686.rpm x86_64: kernel-debug-debuginfo-2.6.32-696.20.1.el6.x86_64.rpm kernel-debuginfo-2.6.32-696.20.1.el6.x86_64.rpm kernel-debuginfo-common-x86_64-2.6.32-696.20.1.el6.x86_64.rpm perf-debuginfo-2.6.32-696.20.1.el6.x86_64.rpm python-perf-2.6.32-696.20.1.el6.x86_64.rpm python-perf-debuginfo-2.6.32-696.20.1.el6.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2017-7542 https://access.redhat.com/security/cve/CVE-2017-9074 https://access.redhat.com/security/cve/CVE-2017-11176 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2018 Red Hat, Inc. - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFaab95XlSAg2UNWIIRAk44AKCIeHQNSDqBJ00EQEnDp0+dzh7xLACfYw7n ur+Q3fd5kODxXjBa2u7yjO8= =CQa1 - -----END PGP SIGNATURE----- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: kernel security and bug fix update Advisory ID: RHSA-2018:0182-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2018:0182 Issue date: 2018-01-25 ===================================================================== 1. Summary: An update for kernel is now available for Red Hat Enterprise Linux 7.3 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux ComputeNode EUS (v. 7.3) - noarch, x86_64 Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.3) - x86_64 Red Hat Enterprise Linux Server EUS (v. 7.3) - noarch, ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional EUS (v. 7.3) - ppc64, ppc64le, x86_64 3. Description: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions (a commonly used performance optimization). There are three primary variants of the issue which differ in the way the speculative execution can be exploited. Note: This issue is present in hardware and cannot be fully fixed via software update. The updated kernel packages provide software mitigation for this hardware issue at a cost of potential performance penalty. Please refer to References section for further information about this issue and the performance impact. In this update initial mitigations for IBM Power (PowerPC) and IBM zSeries (S390) architectures are provided. Variant CVE-2017-5753 triggers the speculative execution by performing a bounds-check bypass. It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory accesses may cause allocation into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to cross the syscall boundary and read privileged memory by conducting targeted cache side-channel attacks. (CVE-2017-5753, Important, PowerPC, S390) Variant CVE-2017-5715 triggers the speculative execution by utilizing branch target injection. It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory accesses may cause allocation into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to cross the syscall and guest/host boundaries and read privileged memory by conducting targeted cache side-channel attacks. (CVE-2017-5715, Important, S390) Variant CVE-2017-5754 relies on the fact that, on impacted microprocessors, during speculative execution of instruction permission faults, exception generation triggered by a faulting access is suppressed until the retirement of the whole instruction block. In a combination with the fact that memory accesses may populate the cache even when the block is being dropped and never committed (executed), an unprivileged local attacker could use this flaw to read privileged (kernel space) memory by conducting targeted cache side-channel attacks. (CVE-2017-5754, Important, PowerPC) Red Hat would like to thank Google Project Zero for reporting these issues. Bug Fix(es): * When attempting to reread parent blocks in btree traversal, the xfs code which deletes extended attributes from an inode assumed that the parent blocks were still on the cache. Under memory pressure and memory reclaim, such parent blocks were sometimes removed from the cache. Consequently, attempts to reread previously cached parent blocks caused the file system to read invalid memory. This update fixes xfs to reinitialize the pointer to the parent block buffers after the block has been reread. As a result, pointers to btree blocks now point to valid memory, and the kernel no longer crashes due to an invalid memory access. (BZ#1512811) * The write access check for huge pages did not function correctly on IBM z Systems. Consequently, if asynchronous I/O reads were used, buffers sometimes contained zeroes rather than data from a file, even when the io_getevents() system call reported that the associated read had finished successfully. This update fixes the write access check in the gup_huge_pmd() function in memory management, and read data is stored in asynchronous I/O buffers properly. (BZ#1513315) * With this update, the rule for iptables reloading has been optimized to complete faster. (BZ#1514040) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 1519778 - CVE-2017-5753 hw: cpu: speculative execution bounds-check bypass 1519780 - CVE-2017-5715 hw: cpu: speculative execution branch target injection 1519781 - CVE-2017-5754 hw: cpu: speculative execution permission faults handling 6. Package List: Red Hat Enterprise Linux ComputeNode EUS (v. 7.3): Source: kernel-3.10.0-514.41.1.el7.src.rpm noarch: kernel-abi-whitelists-3.10.0-514.41.1.el7.noarch.rpm kernel-doc-3.10.0-514.41.1.el7.noarch.rpm x86_64: kernel-3.10.0-514.41.1.el7.x86_64.rpm kernel-debug-3.10.0-514.41.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-514.41.1.el7.x86_64.rpm kernel-debug-devel-3.10.0-514.41.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-514.41.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-514.41.1.el7.x86_64.rpm kernel-devel-3.10.0-514.41.1.el7.x86_64.rpm kernel-headers-3.10.0-514.41.1.el7.x86_64.rpm kernel-tools-3.10.0-514.41.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-514.41.1.el7.x86_64.rpm kernel-tools-libs-3.10.0-514.41.1.el7.x86_64.rpm perf-3.10.0-514.41.1.el7.x86_64.rpm perf-debuginfo-3.10.0-514.41.1.el7.x86_64.rpm python-perf-3.10.0-514.41.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-514.41.1.el7.x86_64.rpm Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.3): x86_64: kernel-debug-debuginfo-3.10.0-514.41.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-514.41.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-514.41.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-514.41.1.el7.x86_64.rpm kernel-tools-libs-devel-3.10.0-514.41.1.el7.x86_64.rpm perf-debuginfo-3.10.0-514.41.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-514.41.1.el7.x86_64.rpm Red Hat Enterprise Linux Server EUS (v. 7.3): Source: kernel-3.10.0-514.41.1.el7.src.rpm noarch: kernel-abi-whitelists-3.10.0-514.41.1.el7.noarch.rpm kernel-doc-3.10.0-514.41.1.el7.noarch.rpm ppc64: kernel-3.10.0-514.41.1.el7.ppc64.rpm kernel-bootwrapper-3.10.0-514.41.1.el7.ppc64.rpm kernel-debug-3.10.0-514.41.1.el7.ppc64.rpm kernel-debug-debuginfo-3.10.0-514.41.1.el7.ppc64.rpm kernel-debug-devel-3.10.0-514.41.1.el7.ppc64.rpm kernel-debuginfo-3.10.0-514.41.1.el7.ppc64.rpm kernel-debuginfo-common-ppc64-3.10.0-514.41.1.el7.ppc64.rpm kernel-devel-3.10.0-514.41.1.el7.ppc64.rpm kernel-headers-3.10.0-514.41.1.el7.ppc64.rpm kernel-tools-3.10.0-514.41.1.el7.ppc64.rpm kernel-tools-debuginfo-3.10.0-514.41.1.el7.ppc64.rpm kernel-tools-libs-3.10.0-514.41.1.el7.ppc64.rpm perf-3.10.0-514.41.1.el7.ppc64.rpm perf-debuginfo-3.10.0-514.41.1.el7.ppc64.rpm python-perf-3.10.0-514.41.1.el7.ppc64.rpm python-perf-debuginfo-3.10.0-514.41.1.el7.ppc64.rpm ppc64le: kernel-3.10.0-514.41.1.el7.ppc64le.rpm kernel-bootwrapper-3.10.0-514.41.1.el7.ppc64le.rpm kernel-debug-3.10.0-514.41.1.el7.ppc64le.rpm kernel-debug-debuginfo-3.10.0-514.41.1.el7.ppc64le.rpm kernel-debuginfo-3.10.0-514.41.1.el7.ppc64le.rpm kernel-debuginfo-common-ppc64le-3.10.0-514.41.1.el7.ppc64le.rpm kernel-devel-3.10.0-514.41.1.el7.ppc64le.rpm kernel-headers-3.10.0-514.41.1.el7.ppc64le.rpm kernel-tools-3.10.0-514.41.1.el7.ppc64le.rpm kernel-tools-debuginfo-3.10.0-514.41.1.el7.ppc64le.rpm kernel-tools-libs-3.10.0-514.41.1.el7.ppc64le.rpm perf-3.10.0-514.41.1.el7.ppc64le.rpm perf-debuginfo-3.10.0-514.41.1.el7.ppc64le.rpm python-perf-3.10.0-514.41.1.el7.ppc64le.rpm python-perf-debuginfo-3.10.0-514.41.1.el7.ppc64le.rpm s390x: kernel-3.10.0-514.41.1.el7.s390x.rpm kernel-debug-3.10.0-514.41.1.el7.s390x.rpm kernel-debug-debuginfo-3.10.0-514.41.1.el7.s390x.rpm kernel-debug-devel-3.10.0-514.41.1.el7.s390x.rpm kernel-debuginfo-3.10.0-514.41.1.el7.s390x.rpm kernel-debuginfo-common-s390x-3.10.0-514.41.1.el7.s390x.rpm kernel-devel-3.10.0-514.41.1.el7.s390x.rpm kernel-headers-3.10.0-514.41.1.el7.s390x.rpm kernel-kdump-3.10.0-514.41.1.el7.s390x.rpm kernel-kdump-debuginfo-3.10.0-514.41.1.el7.s390x.rpm kernel-kdump-devel-3.10.0-514.41.1.el7.s390x.rpm perf-3.10.0-514.41.1.el7.s390x.rpm perf-debuginfo-3.10.0-514.41.1.el7.s390x.rpm python-perf-3.10.0-514.41.1.el7.s390x.rpm python-perf-debuginfo-3.10.0-514.41.1.el7.s390x.rpm x86_64: kernel-3.10.0-514.41.1.el7.x86_64.rpm kernel-debug-3.10.0-514.41.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-514.41.1.el7.x86_64.rpm kernel-debug-devel-3.10.0-514.41.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-514.41.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-514.41.1.el7.x86_64.rpm kernel-devel-3.10.0-514.41.1.el7.x86_64.rpm kernel-headers-3.10.0-514.41.1.el7.x86_64.rpm kernel-tools-3.10.0-514.41.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-514.41.1.el7.x86_64.rpm kernel-tools-libs-3.10.0-514.41.1.el7.x86_64.rpm perf-3.10.0-514.41.1.el7.x86_64.rpm perf-debuginfo-3.10.0-514.41.1.el7.x86_64.rpm python-perf-3.10.0-514.41.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-514.41.1.el7.x86_64.rpm Red Hat Enterprise Linux Server Optional EUS (v. 7.3): ppc64: kernel-debug-debuginfo-3.10.0-514.41.1.el7.ppc64.rpm kernel-debuginfo-3.10.0-514.41.1.el7.ppc64.rpm kernel-debuginfo-common-ppc64-3.10.0-514.41.1.el7.ppc64.rpm kernel-tools-debuginfo-3.10.0-514.41.1.el7.ppc64.rpm kernel-tools-libs-devel-3.10.0-514.41.1.el7.ppc64.rpm perf-debuginfo-3.10.0-514.41.1.el7.ppc64.rpm python-perf-debuginfo-3.10.0-514.41.1.el7.ppc64.rpm ppc64le: kernel-debug-debuginfo-3.10.0-514.41.1.el7.ppc64le.rpm kernel-debug-devel-3.10.0-514.41.1.el7.ppc64le.rpm kernel-debuginfo-3.10.0-514.41.1.el7.ppc64le.rpm kernel-debuginfo-common-ppc64le-3.10.0-514.41.1.el7.ppc64le.rpm kernel-tools-debuginfo-3.10.0-514.41.1.el7.ppc64le.rpm kernel-tools-libs-devel-3.10.0-514.41.1.el7.ppc64le.rpm perf-debuginfo-3.10.0-514.41.1.el7.ppc64le.rpm python-perf-debuginfo-3.10.0-514.41.1.el7.ppc64le.rpm x86_64: kernel-debug-debuginfo-3.10.0-514.41.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-514.41.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-514.41.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-514.41.1.el7.x86_64.rpm kernel-tools-libs-devel-3.10.0-514.41.1.el7.x86_64.rpm perf-debuginfo-3.10.0-514.41.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-514.41.1.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/security/vulnerabilities/speculativeexecution https://access.redhat.com/security/cve/CVE-2017-5753 https://access.redhat.com/security/cve/CVE-2017-5715 https://access.redhat.com/security/cve/CVE-2017-5754 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2018 Red Hat, Inc. - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFaacZpXlSAg2UNWIIRAioFAJ9P+LP2qadmzmAR5WEaU5UvaOifqgCdFhO+ FkImA43txPx8uAAK1eD546Y= =evDX - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBWm5ujIx+lLeg9Ub1AQjnjg//WxdfQSGA5kmnDxVKblgQ4qkJIvxQf/Ok KcMmmMpMHPlAnvvqr6UUKhWZVcSxigyC9jHXPRuRpBRQv3r/vKkE+Az+Eb0uuoaT de3gBFDcmqLTSKooFdLfhE5Y7On5UeJ/ZWnGHR0TumgR2ZLVHb/0ezH+0VHaodkQ 0AfgI+Sztfmy26qc9eOAW7Ca7r3IlzClAPQCb/c/TM6rV0viO23A9wmlNUC5txpB eAYIILB/ceBI06phxRknb1N7Kyt7Dcxv9i1lXkyawv1JjlULkF6sy0HDt06pZe1p 4zITybUVRVh+o4SkQtP55LpX0uLKzEPSdDrsD9fwPMg/Y2E61hsR8Ak2xKtOJ8YB Tw4/Hh1wXgck073eVIQFj/1CnUK86nH1FF+wDwxpQR8fttkxWlPDSjHbgUFdCqdf K2SINbrRqj51rOv9XqPTrXpcC2yquxCpvDxzbL3fvY6+xhzYO56vFfBtzY8ydETy Sg/4bBnpDq1la6O0JNt73w5ZjtZW4iuZcHTHW0arB5vlRoh7S5PyjOcsDrKUGOQ0 u0BDi+l8PXeCd+nNNSAdNhXqyYruCRIKWj+/rILsVJ/LTpKcoyq//8jCJxRJ9oSd Xrfg6c7ABSj2qJmSISJSMKVzrTvKhmlJTWg8/REaz5rPtniK7uNWdl1SSBgfloSp LVHsvP+kzHI= =Rc6Q -----END PGP SIGNATURE-----