Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2021.0843
kernel security and bug fix update
10 March 2021
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: kernel
Publisher: Red Hat
Operating System: Red Hat
Impact/Access: Increased Privileges -- Existing Account
Denial of Service -- Existing Account
Access Confidential Data -- Existing Account
Reduced Security -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2020-25212 CVE-2020-24394
Reference: ESB-2021.0566
ESB-2021.0365
ESB-2020.4406
Original Bulletin:
https://access.redhat.com/errata/RHSA-2021:0760
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: kernel security and bug fix update
Advisory ID: RHSA-2021:0760-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2021:0760
Issue date: 2021-03-09
CVE Names: CVE-2020-24394 CVE-2020-25212
=====================================================================
1. Summary:
An update for kernel is now available for Red Hat Enterprise Linux 7.4
Advanced Update Support, Red Hat Enterprise Linux 7.4 Telco Extended Update
Support, and Red Hat Enterprise Linux 7.4 Update Services for SAP
Solutions.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Server AUS (v. 7.4) - noarch, x86_64
Red Hat Enterprise Linux Server E4S (v. 7.4) - noarch, ppc64le, x86_64
Red Hat Enterprise Linux Server Optional AUS (v. 7.4) - x86_64
Red Hat Enterprise Linux Server Optional E4S (v. 7.4) - ppc64le, x86_64
Red Hat Enterprise Linux Server Optional TUS (v. 7.4) - x86_64
Red Hat Enterprise Linux Server TUS (v. 7.4) - noarch, x86_64
3. Description:
The kernel packages contain the Linux kernel, the core of any Linux
operating system.
Security Fix(es):
* kernel: umask not applied on filesystem without ACL support
(CVE-2020-24394)
* kernel: TOCTOU mismatch in the NFS client code (CVE-2020-25212)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Bug Fix(es):
* Security patch for CVE-2020-25212 breaks directory listings via 'ls' on
NFS V4.2 shares mounted with selinux enabled labels (BZ#1919141)
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
The system must be rebooted for this update to take effect.
5. Bugs fixed (https://bugzilla.redhat.com/):
1869141 - CVE-2020-24394 kernel: umask not applied on filesystem without ACL support
1877575 - CVE-2020-25212 kernel: TOCTOU mismatch in the NFS client code
6. Package List:
Red Hat Enterprise Linux Server AUS (v. 7.4):
Source:
kernel-3.10.0-693.82.1.el7.src.rpm
noarch:
kernel-abi-whitelists-3.10.0-693.82.1.el7.noarch.rpm
kernel-doc-3.10.0-693.82.1.el7.noarch.rpm
x86_64:
kernel-3.10.0-693.82.1.el7.x86_64.rpm
kernel-debug-3.10.0-693.82.1.el7.x86_64.rpm
kernel-debug-debuginfo-3.10.0-693.82.1.el7.x86_64.rpm
kernel-debug-devel-3.10.0-693.82.1.el7.x86_64.rpm
kernel-debuginfo-3.10.0-693.82.1.el7.x86_64.rpm
kernel-debuginfo-common-x86_64-3.10.0-693.82.1.el7.x86_64.rpm
kernel-devel-3.10.0-693.82.1.el7.x86_64.rpm
kernel-headers-3.10.0-693.82.1.el7.x86_64.rpm
kernel-tools-3.10.0-693.82.1.el7.x86_64.rpm
kernel-tools-debuginfo-3.10.0-693.82.1.el7.x86_64.rpm
kernel-tools-libs-3.10.0-693.82.1.el7.x86_64.rpm
perf-3.10.0-693.82.1.el7.x86_64.rpm
perf-debuginfo-3.10.0-693.82.1.el7.x86_64.rpm
python-perf-3.10.0-693.82.1.el7.x86_64.rpm
python-perf-debuginfo-3.10.0-693.82.1.el7.x86_64.rpm
Red Hat Enterprise Linux Server E4S (v. 7.4):
Source:
kernel-3.10.0-693.82.1.el7.src.rpm
noarch:
kernel-abi-whitelists-3.10.0-693.82.1.el7.noarch.rpm
kernel-doc-3.10.0-693.82.1.el7.noarch.rpm
ppc64le:
kernel-3.10.0-693.82.1.el7.ppc64le.rpm
kernel-bootwrapper-3.10.0-693.82.1.el7.ppc64le.rpm
kernel-debug-3.10.0-693.82.1.el7.ppc64le.rpm
kernel-debug-debuginfo-3.10.0-693.82.1.el7.ppc64le.rpm
kernel-debuginfo-3.10.0-693.82.1.el7.ppc64le.rpm
kernel-debuginfo-common-ppc64le-3.10.0-693.82.1.el7.ppc64le.rpm
kernel-devel-3.10.0-693.82.1.el7.ppc64le.rpm
kernel-headers-3.10.0-693.82.1.el7.ppc64le.rpm
kernel-tools-3.10.0-693.82.1.el7.ppc64le.rpm
kernel-tools-debuginfo-3.10.0-693.82.1.el7.ppc64le.rpm
kernel-tools-libs-3.10.0-693.82.1.el7.ppc64le.rpm
perf-3.10.0-693.82.1.el7.ppc64le.rpm
perf-debuginfo-3.10.0-693.82.1.el7.ppc64le.rpm
python-perf-3.10.0-693.82.1.el7.ppc64le.rpm
python-perf-debuginfo-3.10.0-693.82.1.el7.ppc64le.rpm
x86_64:
kernel-3.10.0-693.82.1.el7.x86_64.rpm
kernel-debug-3.10.0-693.82.1.el7.x86_64.rpm
kernel-debug-debuginfo-3.10.0-693.82.1.el7.x86_64.rpm
kernel-debug-devel-3.10.0-693.82.1.el7.x86_64.rpm
kernel-debuginfo-3.10.0-693.82.1.el7.x86_64.rpm
kernel-debuginfo-common-x86_64-3.10.0-693.82.1.el7.x86_64.rpm
kernel-devel-3.10.0-693.82.1.el7.x86_64.rpm
kernel-headers-3.10.0-693.82.1.el7.x86_64.rpm
kernel-tools-3.10.0-693.82.1.el7.x86_64.rpm
kernel-tools-debuginfo-3.10.0-693.82.1.el7.x86_64.rpm
kernel-tools-libs-3.10.0-693.82.1.el7.x86_64.rpm
perf-3.10.0-693.82.1.el7.x86_64.rpm
perf-debuginfo-3.10.0-693.82.1.el7.x86_64.rpm
python-perf-3.10.0-693.82.1.el7.x86_64.rpm
python-perf-debuginfo-3.10.0-693.82.1.el7.x86_64.rpm
Red Hat Enterprise Linux Server TUS (v. 7.4):
Source:
kernel-3.10.0-693.82.1.el7.src.rpm
noarch:
kernel-abi-whitelists-3.10.0-693.82.1.el7.noarch.rpm
kernel-doc-3.10.0-693.82.1.el7.noarch.rpm
x86_64:
kernel-3.10.0-693.82.1.el7.x86_64.rpm
kernel-debug-3.10.0-693.82.1.el7.x86_64.rpm
kernel-debug-debuginfo-3.10.0-693.82.1.el7.x86_64.rpm
kernel-debug-devel-3.10.0-693.82.1.el7.x86_64.rpm
kernel-debuginfo-3.10.0-693.82.1.el7.x86_64.rpm
kernel-debuginfo-common-x86_64-3.10.0-693.82.1.el7.x86_64.rpm
kernel-devel-3.10.0-693.82.1.el7.x86_64.rpm
kernel-headers-3.10.0-693.82.1.el7.x86_64.rpm
kernel-tools-3.10.0-693.82.1.el7.x86_64.rpm
kernel-tools-debuginfo-3.10.0-693.82.1.el7.x86_64.rpm
kernel-tools-libs-3.10.0-693.82.1.el7.x86_64.rpm
perf-3.10.0-693.82.1.el7.x86_64.rpm
perf-debuginfo-3.10.0-693.82.1.el7.x86_64.rpm
python-perf-3.10.0-693.82.1.el7.x86_64.rpm
python-perf-debuginfo-3.10.0-693.82.1.el7.x86_64.rpm
Red Hat Enterprise Linux Server Optional AUS (v. 7.4):
x86_64:
kernel-debug-debuginfo-3.10.0-693.82.1.el7.x86_64.rpm
kernel-debuginfo-3.10.0-693.82.1.el7.x86_64.rpm
kernel-debuginfo-common-x86_64-3.10.0-693.82.1.el7.x86_64.rpm
kernel-tools-debuginfo-3.10.0-693.82.1.el7.x86_64.rpm
kernel-tools-libs-devel-3.10.0-693.82.1.el7.x86_64.rpm
perf-debuginfo-3.10.0-693.82.1.el7.x86_64.rpm
python-perf-debuginfo-3.10.0-693.82.1.el7.x86_64.rpm
Red Hat Enterprise Linux Server Optional E4S (v. 7.4):
ppc64le:
kernel-debug-debuginfo-3.10.0-693.82.1.el7.ppc64le.rpm
kernel-debug-devel-3.10.0-693.82.1.el7.ppc64le.rpm
kernel-debuginfo-3.10.0-693.82.1.el7.ppc64le.rpm
kernel-debuginfo-common-ppc64le-3.10.0-693.82.1.el7.ppc64le.rpm
kernel-tools-debuginfo-3.10.0-693.82.1.el7.ppc64le.rpm
kernel-tools-libs-devel-3.10.0-693.82.1.el7.ppc64le.rpm
perf-debuginfo-3.10.0-693.82.1.el7.ppc64le.rpm
python-perf-debuginfo-3.10.0-693.82.1.el7.ppc64le.rpm
x86_64:
kernel-debug-debuginfo-3.10.0-693.82.1.el7.x86_64.rpm
kernel-debuginfo-3.10.0-693.82.1.el7.x86_64.rpm
kernel-debuginfo-common-x86_64-3.10.0-693.82.1.el7.x86_64.rpm
kernel-tools-debuginfo-3.10.0-693.82.1.el7.x86_64.rpm
kernel-tools-libs-devel-3.10.0-693.82.1.el7.x86_64.rpm
perf-debuginfo-3.10.0-693.82.1.el7.x86_64.rpm
python-perf-debuginfo-3.10.0-693.82.1.el7.x86_64.rpm
Red Hat Enterprise Linux Server Optional TUS (v. 7.4):
x86_64:
kernel-debug-debuginfo-3.10.0-693.82.1.el7.x86_64.rpm
kernel-debuginfo-3.10.0-693.82.1.el7.x86_64.rpm
kernel-debuginfo-common-x86_64-3.10.0-693.82.1.el7.x86_64.rpm
kernel-tools-debuginfo-3.10.0-693.82.1.el7.x86_64.rpm
kernel-tools-libs-devel-3.10.0-693.82.1.el7.x86_64.rpm
perf-debuginfo-3.10.0-693.82.1.el7.x86_64.rpm
python-perf-debuginfo-3.10.0-693.82.1.el7.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2020-24394
https://access.redhat.com/security/cve/CVE-2020-25212
https://access.redhat.com/security/updates/classification/#moderate
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2021 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBYEc+X9zjgjWX9erEAQhNtA//ZW255TWAuB3fQ3zwQq90dvDZGvyPsv9q
0AyJ2Z2BzhBsEfsSDqwm5mtjWFZWdTBiFwp4zLNd48+faut/WMmTsxA51BXJow42
S2Q+mX9iJMwuUFoSdtk+EVlbTyZH3rJpDVjkjDmJP4Gq5N8LgHbwn1cZwKwpb6AB
NeiUPiW0XSCV0DkGkDFZk373eNUp938T8PKS7Aq+xPZoahlOAdx+9dKYrEIOYoiM
ggMad7WIkWo3SrXaoJ26aC62PB97MsaTYtbe6RYDI9uhlwr3kEo6H5gwuYuXNlVz
BHcBGQZ/Bd9Dg4BAA6DPaTL4aJupxyUPoyMOEic7cKxAGseqZWj3OZOaP4L2lOUQ
6u/mujIe0uOaTQ3qKzGCEQb483KVJeP6HB2tiWW1utT2CaCc9C562C4HZ8aqRV2W
RnplSS/FDXCBrFW7nEpmIKDb8OUJgdrk0CnJ7BjAZm9nmH71rROsKV5zdXp4muCE
kF/b7zq/V0g5JWPM9aF0bdFH5BeJYb2gnUs9cQV0szDqdJJrRmrDzCuOOND0MMjV
lsRddLJDmz8znYtGmFubIEGLerHPYB601lEwDBa5Z3JzN0zeJXo5DpDstpe0D601
aHHQaPgYFIrse9bY4k5ydMmIyqoeCWwjJcNNECPBmKzyyZry8sddqp1le5xBgwxk
rJ+yLW5g+eU=
=1EW1
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBYEgNe+NLKJtyKPYoAQj1bQ//bLSStwIkdkyi5Ejpky8BjsxxU4myIraX
RPLkUg9h5FJhQsvvAc+DStykl9HMWM3txZcL6MdcaCHxJy9Vu2FHM7Nv1N9/RzMw
6IL4oaRAC28+hd/0VWJZ5dfjY8mEvLsokeJ70lmBts2HkH2qB0s7CZNpOAtwdyJf
l7lfXvU8eWlMkmqiw6weF4ukpK0ed06iD+Gjp/U96qw0xkycGRAyJMEEVenBsoe/
0fAGQ3qn9FDQy8MAicATNM7/RGk7Fcf3fV7dw/9wrBs5zOt+00Cfdu5CSl3KaojI
uTUclsFVOjzLoObkJ26CiWCnkVTaUFNkX0/xK80yxaA26t8hF6kPQWf1VjWYNs1u
iumz7UMBB5uYPh1PjVawipGYu9vb3D7VbX+4M15D8EEjv/5bpS4dKeMaejJyvdAQ
GlocYvhCX2aNxCHmipF6fpd844WAs3amW9XZjli7XYnMwmKDqroTiWlSpHyrqb92
x3UWHTLG76A9xj8eiE75LGNDKe+qKX6CMrQX/F9gD/xv+cIGSUHcemGZVEbrHEi5
a45vwXP/2DSKWSJdSmknuTee2gYWjTVZBNlCj2EWYXYXtw8eFHUoT5UYQ/3O67da
X2onM1HAEM+hOuJQdAR8//nTgIkYC3s3CvM3RtSO2AjFZHBfGGfZuXQ1ClDkJw1J
HWAexE842UE=
=XlCU
-----END PGP SIGNATURE-----