Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions update for kernel
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 13 |
| CVE-ID | CVE-2018-12207 CVE-2018-16884 CVE-2019-0154 CVE-2019-0155 CVE-2019-10126 CVE-2019-11135 CVE-2019-11478 CVE-2019-14816 CVE-2019-14821 CVE-2019-14901 CVE-2019-3900 CVE-2019-5489 CVE-2019-9506 |
| CWE-ID | CWE-119 CWE-416 CWE-284 CWE-122 CWE-399 CWE-400 CWE-787 CWE-835 CWE-200 CWE-310 |
| Exploitation vector | Network |
| Public exploit |
Public exploit code for vulnerability #2 is available. Public exploit code for vulnerability #3 is available. Public exploit code for vulnerability #6 is available. Public exploit code for vulnerability #12 is available. |
| Vulnerable software |
kernel (Red Hat package) Operating systems & Components / Operating system package or component |
| Vendor | Red Hat Inc. |
Security Bulletin
This security bulletin contains information about 13 vulnerabilities.
1) Buffer overflow
EUVDB-ID: #VU22712
Risk: Low
CVSSv4.0: 2.1 [CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2018-12207
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform denial of service (DoS) attack.
The vulnerability exists due to a boundary error in the mechanism responsible for error handling on some Intel platforms. A local user of a guest operating system can use a specially crafted application to trigger memory corruption and cause the host system to stop responding.
Successful exploitation of this vulnerability may result in a denial of service (DoS) attack.
Below is the list of processor families that are affected by this vulnerability:
Client:
- Intel Core i3 Processors
- Intel Core i5 Processors
- Intel Core i7 Processors
- Intel Core m Processor Family
- 2nd generation Intel Core Processors
- 3rd generation Intel Core Processors
- 4th generation Intel Core Processors
- 5th generation Intel Core Processors
- 6th generation Intel Core Processors
- 7th generation Intel Core Processors
- 8th generation Intel Core Processors
- Intel Core X-series Processor Family
- Intel Pentium Gold Processor Series
- Intel Celeron Processor G Series
Server:
- 2nd Generation Intel Xeon Scalable Processors
- Intel Xeon Scalable Processors
- Intel Xeon Processor E7 v4 Family
- Intel Xeon Processor E7 v3 Family
- Intel Xeon Processor E7 v2 Family
- Intel Xeon Processor E7 Family
- Intel Xeon Processor E5 v4 Family
- Intel Xeon Processor E5 v3 Family
- Intel Xeon Processor E5 v2 Family
- Intel Xeon Processor E5 Family
- Intel Xeon Processor E3 v6 Family
- Intel Xeon Processor E3 v5 Family
- Intel Xeon Processor E3 v4 Family
- Intel Xeon Processor E3 v3 Family
- Intel Xeon Processor E3 v2 Family
- Intel Xeon Processor E3 Family
- Intel Xeon E Processor
- Intel Xeon D Processor
- Intel Xeon W Processor
- Legacy Intel Xeon Processor
Install updates from vendor's website.
kernel (Red Hat package): before 4.18.0-80.15.1.el8_0
CPE2.3 External linkshttps://access.redhat.com/errata/RHSA-2020:0204
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Use-after-free error
EUVDB-ID: #VU16616
Risk: Low
CVSSv4.0: 7.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear]
CVE-ID: CVE-2018-16884
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to cause DoS condition on the target system.
The vulnerability exists due to bc_svc_process() use wrong back-channel id when NFS41+ shares mounted in different network namespaces at the same time. A remote attacker can use a malicious container to trigger use-after-free error and cause a system panic.
MitigationInstall updates from vendor's website.
kernel (Red Hat package): before 4.18.0-80.15.1.el8_0
CPE2.3 External linkshttps://access.redhat.com/errata/RHSA-2020:0204
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
3) Improper access control
EUVDB-ID: #VU22743
Risk: Low
CVSSv4.0: 5.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear]
CVE-ID: CVE-2019-0154
CWE-ID:
CWE-284 - Improper Access Control
Exploit availability: No
DescriptionThe vulnerability allows a local user to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions. A local user with the ability to issue an ioctl can trigger a hardware level crash if MMIO registers were read while the graphics card was in a low-power state and cause a denial of service (DoS) on the target system.
MitigationInstall updates from vendor's website.
kernel (Red Hat package): before 4.18.0-80.15.1.el8_0
CPE2.3 External linkshttps://access.redhat.com/errata/RHSA-2020:0204
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
4) Improper access control
EUVDB-ID: #VU22755
Risk: Low
CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2019-0155
CWE-ID:
CWE-284 - Improper Access Control
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to improper access restrictions in Intel GPU subsystem. A local unprivileged user can perform blitter manipulation manipulation and write data to arbitrary location in kernel memory. As a result a local authenticated user can execute arbitrary code on the system with superuser privileges.
This vulnerability affects the following Intel products:
- 6th, 7th, 8th and 9th Generation Intel(R) Core(TM) Processor Families
- Intel(R) Pentium(R) Processor J, N, Silver and Gold Series
- Intel(R) Celeron(R) Processor J, N, G3900 and G4900 Series
- Intel(R) Atom(R) Processor A and E3900 Series
- Intel(R) Xeon(R) Processor E3-1500 v5 and v6, E-2100 and E-2200 Processor Families
- Intel(R) Graphics Driver for Windows before 26.20.100.6813 (DCH) or 26.20.100.6812 and before 21.20.x.5077 (aka15.45.5077)
- i915 Linux Driver for Intel(R) Processor Graphics before versions 5.4-rc7, 5.3.11, 4.19.84, 4.14.154, 4.9.201, 4.4.201
MitigationInstall updates from vendor's website.
kernel (Red Hat package): before 4.18.0-80.15.1.el8_0
CPE2.3 External linkshttps://access.redhat.com/errata/RHSA-2020:0204
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
5) Heap-based buffer overflow
EUVDB-ID: #VU20810
Risk: Low
CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2019-10126
CWE-ID:
CWE-122 - Heap-based Buffer Overflow
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service (DoS) condition or execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in the Marvell Wireless LAN device driver in "mwifiex_uap_parse_tail_ies" function in "drivers/net/wireless/marvell/mwifiex/ie.c". A local authenticated user can trigger heap-based buffer overflow and cause a denial of service (system crash) or possibly execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
kernel (Red Hat package): before 4.18.0-80.15.1.el8_0
CPE2.3 External linkshttps://access.redhat.com/errata/RHSA-2020:0204
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
6) Resource management error
EUVDB-ID: #VU22704
Risk: Low
CVSSv4.0: 4.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear]
CVE-ID: CVE-2019-11135
CWE-ID:
CWE-399 - Resource Management Errors
Exploit availability: No
DescriptionThe vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition within the TSX Asynchronous Abort (TAA) in Intel CPUs. The TAA condition, on some microprocessors utilizing speculative execution, may allow an authenticated user to potentially enable information disclosure via a side channel. MitigationInstall updates from vendor's website.
kernel (Red Hat package): before 4.18.0-80.15.1.el8_0
CPE2.3 External linkshttps://access.redhat.com/errata/RHSA-2020:0204
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
7) Resource exhaustion
EUVDB-ID: #VU18946
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2019-11478
CWE-ID:
CWE-400 - Resource exhaustion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform denial of service (DoS) attack.
The vulnerability exists due to an error when processing TCP Selective Acknowledgment (SACK) sequences within the Linux kernel TCP retransmission queue implementation in tcp_fragment. A remote non-authenticated attacker can send specially crafted network traffic to the affected system and perform a denial of service (DoS) attack.
Mitigation
Install updates from vendor's website.
kernel (Red Hat package): before 4.18.0-80.15.1.el8_0
CPE2.3 External linkshttps://access.redhat.com/errata/RHSA-2020:0204
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
8) Heap-based buffer overflow
EUVDB-ID: #VU21444
Risk: Low
CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2019-14816
CWE-ID:
CWE-122 - Heap-based Buffer Overflow
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error within the mwifiex_set_wmm_params() function in the Marvell Wi-Fi chip driver in Linux kernel. A local user can run a specially crafted application to trigger a heap-based buffer overflow and execute arbitrary code on the system with elevated privileges.
Mitigation
Install updates from vendor's website.
kernel (Red Hat package): before 4.18.0-80.15.1.el8_0
CPE2.3 External linkshttps://access.redhat.com/errata/RHSA-2020:0204
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
9) Out-of-bounds write
EUVDB-ID: #VU21255
Risk: Low
CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2019-14821
CWE-ID:
CWE-787 - Out-of-bounds write
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error in the KVM coalesced MMIO support functionality due to incorrect processing of shared indexes. A local user can run a specially crafted application to trigger an out-of-bounds write error and write data to arbitrary address in the kernel memory.
Successful vulnerability exploitation may allow an attacker to execute arbitrary code on the system with root privileges.
MitigationInstall updates from vendor's website.
kernel (Red Hat package): before 4.18.0-80.15.1.el8_0
CPE2.3 External linkshttps://access.redhat.com/errata/RHSA-2020:0204
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
10) Out-of-bounds write
EUVDB-ID: #VU24684
Risk: Medium
CVSSv4.0: 6.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2019-14901
CWE-ID:
CWE-787 - Out-of-bounds write
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a boundary error when processing untrusted input in Marvell WiFi chip driver within the "mwifiex_process_tdls_action_frame()" function in "marvell/mwifiex/tdls.c". A remote attacker on the local network can send a specially crafted network traffic, trigger out-of-bounds write and execute arbitrary code on the target system.
MitigationInstall updates from vendor's website.
kernel (Red Hat package): before 4.18.0-80.15.1.el8_0
CPE2.3 External linkshttps://access.redhat.com/errata/RHSA-2020:0204
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
11) Infinite loop
EUVDB-ID: #VU19998
Risk: Low
CVSSv4.0: 1.2 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2019-3900
CWE-ID:
CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop in vhost_net kernel module when processing incoming packets in handle_rx(). A remote attacker with access to guest operating system can stall the vhost_net kernel thread and cause denial of service conditions.
MitigationInstall updates from vendor's website.
kernel (Red Hat package): before 4.18.0-80.15.1.el8_0
CPE2.3 External linkshttps://access.redhat.com/errata/RHSA-2020:0204
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
12) Information disclosure
EUVDB-ID: #VU16896
Risk: Low
CVSSv4.0: 5.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear]
CVE-ID: CVE-2019-5489
CWE-ID:
CWE-200 - Information exposure
Exploit availability: No
DescriptionThe vulnerability allows a local attacker to gain access to potentially sensitive information.
The vulnerability exists due to a flaw in the mincore() implementation in mm/mincore.c. A local attacker can observe page cache access patterns of other processes on the same system and sniff secret information.
MitigationInstall updates from vendor's website.
kernel (Red Hat package): before 4.18.0-80.15.1.el8_0
CPE2.3 External linkshttps://access.redhat.com/errata/RHSA-2020:0204
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
13) Cryptographic issues
EUVDB-ID: #VU20290
Risk: Low
CVSSv4.0: 0.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2019-9506
CWE-ID:
CWE-310 - Cryptographic Issues
Exploit availability: No
DescriptionThe vulnerability allows an attacker to gain access to sensitive information.
The vulnerability exists due to a weakness in Bluetooth Basic Rate/Enhanced Data Rate (BR/EDR) protocol core specification that allows an attacker with close proximity to the affected system to perform a man-in-the-middle attack on an encrypted Bluetooth connection.
Successful exploitation of the vulnerability may allow an attacker to gain access to sensitive information or perform unauthorized actions.
MitigationInstall updates from vendor's website.
kernel (Red Hat package): before 4.18.0-80.15.1.el8_0
CPE2.3 External linkshttps://access.redhat.com/errata/RHSA-2020:0204
Q & A
Can this vulnerability be exploited remotely?
No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
