Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2020.0050 kpatch-patch security update 7 January 2020 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: kpatch-patch Publisher: Red Hat Operating System: Red Hat Enterprise Linux Server 7 Impact/Access: Root Compromise -- Existing Account Denial of Service -- Existing Account Resolution: Patch/Upgrade CVE Names: CVE-2019-15239 CVE-2019-14821 Reference: ASB-2019.0342 ESB-2019.4698 ESB-2019.4059 ESB-2019.3505.3 Original Bulletin: https://access.redhat.com/errata/RHSA-2020:0027 - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: kpatch-patch security update Advisory ID: RHSA-2020:0027-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2020:0027 Issue date: 2020-01-06 CVE Names: CVE-2019-14821 CVE-2019-15239 ===================================================================== 1. Summary: An update for kpatch-patch is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Server (v. 7) - ppc64le, x86_64 3. Description: This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify the code of a running kernel. Security fix(es): * Kernel: KVM: OOB memory access via mmio ring buffer (CVE-2019-14821) * kernel: local attacker can trigger multiple use-after-free conditions results in privilege escalation (CVE-2019-15239) For more details about the security issue(s), including the impact, a CVSS score, acknowledgements, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1746708 - CVE-2019-14821 Kernel: KVM: OOB memory access via mmio ring buffer 1747353 - CVE-2019-15239 kernel: local attacker can trigger multiple use-after-free conditions results in privilege escalation 6. Package List: Red Hat Enterprise Linux Server (v. 7): Source: kpatch-patch-3_10_0-1062-1-11.el7.src.rpm kpatch-patch-3_10_0-1062_1_1-1-10.el7.src.rpm kpatch-patch-3_10_0-1062_1_2-1-9.el7.src.rpm kpatch-patch-3_10_0-1062_4_1-1-6.el7.src.rpm kpatch-patch-3_10_0-1062_4_2-1-3.el7.src.rpm kpatch-patch-3_10_0-1062_4_3-1-3.el7.src.rpm ppc64le: kpatch-patch-3_10_0-1062-1-11.el7.ppc64le.rpm kpatch-patch-3_10_0-1062-debuginfo-1-11.el7.ppc64le.rpm kpatch-patch-3_10_0-1062_1_1-1-10.el7.ppc64le.rpm kpatch-patch-3_10_0-1062_1_1-debuginfo-1-10.el7.ppc64le.rpm kpatch-patch-3_10_0-1062_1_2-1-9.el7.ppc64le.rpm kpatch-patch-3_10_0-1062_1_2-debuginfo-1-9.el7.ppc64le.rpm kpatch-patch-3_10_0-1062_4_1-1-6.el7.ppc64le.rpm kpatch-patch-3_10_0-1062_4_1-debuginfo-1-6.el7.ppc64le.rpm kpatch-patch-3_10_0-1062_4_2-1-3.el7.ppc64le.rpm kpatch-patch-3_10_0-1062_4_3-1-3.el7.ppc64le.rpm x86_64: kpatch-patch-3_10_0-1062-1-11.el7.x86_64.rpm kpatch-patch-3_10_0-1062-debuginfo-1-11.el7.x86_64.rpm kpatch-patch-3_10_0-1062_1_1-1-10.el7.x86_64.rpm kpatch-patch-3_10_0-1062_1_1-debuginfo-1-10.el7.x86_64.rpm kpatch-patch-3_10_0-1062_1_2-1-9.el7.x86_64.rpm kpatch-patch-3_10_0-1062_1_2-debuginfo-1-9.el7.x86_64.rpm kpatch-patch-3_10_0-1062_4_1-1-6.el7.x86_64.rpm kpatch-patch-3_10_0-1062_4_1-debuginfo-1-6.el7.x86_64.rpm kpatch-patch-3_10_0-1062_4_2-1-3.el7.x86_64.rpm kpatch-patch-3_10_0-1062_4_3-1-3.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2019-14821 https://access.redhat.com/security/cve/CVE-2019-15239 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2020 Red Hat, Inc. - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBXhNIa9zjgjWX9erEAQgL7g/+KHMclWoiAWHKD2AaBU7fFzR7bQQrmJpC 9srW9hXHJL2ao/OGs2CtuqUtpn0c4ceewb52BoNWGbCP8PfFopCJKo+SQhiPMIyK vN5peDu9hw6MfQthoh9MYV4XXNDaHhYzcgauJMU1g1e3psa2WvyBg5ydwFNSzImO 6VgZW7lg7AtjwGQr0KUNCjFBO4JZ87btVxjdMkikeLuU4X2DFqao9PUxAcd5PZwL snVI8n0D7KTPDcn6/KH5D/PNpaW6JJ75cWv+HjwrGyVlsImUEFiXT15AhFHqM9sA gh5l8z4JMobSoKClwA0rzWjIHhBHj3Mx0g/0zOsqX/rLEEms1MUSTg01OwedWn1M W4Qljw9fFOe98/v5fFK8E2mMd6sMPAa6DZ6+4FQQEM1QK80KUtWDN4mS1O7MlKZy Q5S7bTX233Vh07P3AjJcWeSJcoR4m2L7/uWSCvmycSqPZv3KDpl5k25AZe5XUbEn wcsUkTbAd0jCtvHyp9rtycDMUWllU2JsvBnI83cFQkQKmMzRYu5+uUU92lDb2tsD qGf/J/gAPb2aUX5Gebqf121bEyPbRc31JAPWlk+4gd9oYacsHWQP3bcmtHMDc/mX 88X3ahJEV0C3FW1P6UsmEMr8gpNmMPyBLoVmGPD1frO2E/PP+7GWP97E1lQeH3oO 6rORZ9ETl3Y= =0iDJ - -----END PGP SIGNATURE----- - -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBXhQH42aOgq3Tt24GAQizgxAAqO06n3srxj04dHKPeK573v5kKBv+0NIE SGgLkEiujCV2PDpuHcYTgJnF0HNOv0NF2dnZZfMHChNW1qks0aUl9+Nr57veAQ/Q DcYSAyxHK5BCoAschwDFg9YL6OWAdepUAeSqVYJmDTqWeeYTqfXpeNii9SfSNaZ9 0SGQSirCD9xpkw/arKNVPUiCaIJI3cp/r8HW93FORMJUA5CPmG1beJ2bVMgaJUSw hMUvxKkENvKXfsVvZUPNOEtgB4Zah6mTJucxbc0UeIKwzdhHh82jqokIOcRBkPL6 ziq97R2DCjekp7JxK1AAtBIQmBrL4sE5PpmYtDhinAQCBkOPmJKpHojCupr7uCMq 51032iI7MUV3G38og/a+80NyTRj19wUYOslCRHOyaUAYPQVzwSH2pBfKVx5ZbjuZ wWBmld3ubIWwd5cBcKEgSVT3VP8DTbk58rMQrg6VfMRTaKy0cV030H16YyQgycI4 6v1fMZZFks8XQ6CqKcw1WJZbTuUPOoR1fw/B5WiRDlFE13SUY6tEzDL9cODsSKTP ExRJlwjTCpS5y34d3PNsGSwpEwRmn3yjWQIuFaf7jTn66xHnH1i3P3zn3syFArcC DJr8zUod59WQYFiIkAFX/ZjW6S5qwc3tL5HCXxbyAXvVRK9i+rS5MLLovtq/tzI5 fawAF7FqelI= =v5r0 -----END PGP SIGNATURE-----