Red Hat Enterprise Linux 7 update for kernel-alt

Published: 2020-03-09

Risk	High
Patch available	YES
Number of vulnerabilities	8
CVE-ID	CVE-2018-16871 CVE-2019-11884 CVE-2019-15030 CVE-2019-15916 CVE-2019-17666 CVE-2019-18805 CVE-2019-3459 CVE-2019-3460
CWE-ID	CWE-476 CWE-200 CWE-20 CWE-401 CWE-119 CWE-190
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	Red Hat Enterprise Linux for IBM System z (Structure A) Operating systems & Components / Operating system Red Hat Enterprise Linux for Power 9 Operating systems & Components / Operating system Red Hat Enterprise Linux for ARM 64 Operating systems & Components / Operating system kernel-alt (Red Hat package) Operating systems & Components / Operating system package or component
Vendor	Red Hat Inc.

Security Bulletin

This security bulletin contains information about 8 vulnerabilities.

1) NULL pointer dereference

EUVDB-ID: #VU19573

Risk: Medium

CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2018-16871

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in the Network File System (NFS) implementation. A remote authenticated attacker can mount an exported NFS filesystem, cause a NULL pointer dereference condition due to an invalid NFS sequence and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for IBM System z (Structure A): 7.0

Red Hat Enterprise Linux for Power 9: 7.0

Red Hat Enterprise Linux for ARM 64: 7.0

kernel-alt (Red Hat package): before 4.14.0-115.18.1.el7a

CPE2.3

External links

https://access.redhat.com/errata/RHSA-2020:0740

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Information disclosure

EUVDB-ID: #VU20811

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-11884

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

Exploit availability: No

Description

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability in the "do_hidp_sock_ioctl" function in "net/bluetooth/hidp/sock.c" exists due to the Bluetooth Human Interface Device Protocol (HIDP) implementation did not properly verify strings were NULL terminated in certain situations. A local authenticated user can gain unauthorized access to sensitive information from kernel stack memory via a "HIDPCONNADD" command, because a name field may not end with a '' character.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for IBM System z (Structure A): 7.0

Red Hat Enterprise Linux for Power 9: 7.0

Red Hat Enterprise Linux for ARM 64: 7.0

kernel-alt (Red Hat package): before 4.14.0-115.18.1.el7a

CPE2.3

External links

https://access.redhat.com/errata/RHSA-2020:0740

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Input validation error

EUVDB-ID: #VU28402

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-15030

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local authenticated user to #BASIC_IMPACT#.

In the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector registers of other users' processes via a Facility Unavailable exception. To exploit the venerability, a local user starts a transaction (via the hardware transactional memory instruction tbegin) and then accesses vector registers. At some point, the vector registers will be corrupted with the values from a different local Linux process because of a missing arch/powerpc/kernel/process.c check.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for IBM System z (Structure A): 7.0

Red Hat Enterprise Linux for Power 9: 7.0

Red Hat Enterprise Linux for ARM 64: 7.0

kernel-alt (Red Hat package): before 4.14.0-115.18.1.el7a

CPE2.3

External links

https://access.redhat.com/errata/RHSA-2020:0740

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Memory leak

EUVDB-ID: #VU22569

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-15916

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within register_queue_kobjects() function in net/core/net-sysfs.c, which will cause denial of service. A local user can perform a denial of service attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for IBM System z (Structure A): 7.0

Red Hat Enterprise Linux for Power 9: 7.0

Red Hat Enterprise Linux for ARM 64: 7.0

kernel-alt (Red Hat package): before 4.14.0-115.18.1.el7a

CPE2.3

External links

https://access.redhat.com/errata/RHSA-2020:0740

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Buffer overflow

EUVDB-ID: #VU22595

Risk: Medium

CVSSv4.0: 6.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-17666

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the P2P (Wifi-Direct) functionality in rtl_p2p_noa_ie() function in drivers/net/wireless/realtek/rtlwifi/ps.c in Linux kernel when processing Notice and Absence frames. A remote attacker can send specially crafted data via the wireless network, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for IBM System z (Structure A): 7.0

Red Hat Enterprise Linux for Power 9: 7.0

Red Hat Enterprise Linux for ARM 64: 7.0

kernel-alt (Red Hat package): before 4.14.0-115.18.1.el7a

CPE2.3

External links

https://access.redhat.com/errata/RHSA-2020:0740

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Integer overflow

EUVDB-ID: #VU30638

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2019-18805

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

An issue was discovered in net/ipv4/sysctl_net_ipv4.c in the Linux kernel before 5.0.11. There is a net/ipv4/tcp_input.c signed integer overflow in tcp_ack_update_rtt() when userspace writes a very large integer to /proc/sys/net/ipv4/tcp_min_rtt_wlen, leading to a denial of service or possibly unspecified other impact, aka CID-19fad20d15a6.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for IBM System z (Structure A): 7.0

Red Hat Enterprise Linux for Power 9: 7.0

Red Hat Enterprise Linux for ARM 64: 7.0

kernel-alt (Red Hat package): before 4.14.0-115.18.1.el7a

CPE2.3

External links

https://access.redhat.com/errata/RHSA-2020:0740

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Memory leak

EUVDB-ID: #VU17762

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-3459

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local attacker to obtain potentially sensitive information on the target system.

The vulnerability exists due heap address infoleak in use of l2cap_get_conf_opt. A local attacker can trigger memory leak and access important data.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for IBM System z (Structure A): 7.0

Red Hat Enterprise Linux for Power 9: 7.0

Red Hat Enterprise Linux for ARM 64: 7.0

kernel-alt (Red Hat package): before 4.14.0-115.18.1.el7a

CPE2.3

External links

https://access.redhat.com/errata/RHSA-2020:0740

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Memory leak

EUVDB-ID: #VU17763

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-3460

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local attacker to obtain potentially sensitive information on the target system.

The vulnerability exists due heap address infoleak in multiple locations including function l2cap_parse_conf_rsp. A local attacker can trigger memory leak and access important data.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for IBM System z (Structure A): 7.0

Red Hat Enterprise Linux for Power 9: 7.0

Red Hat Enterprise Linux for ARM 64: 7.0

kernel-alt (Red Hat package): before 4.14.0-115.18.1.el7a

CPE2.3

External links

https://access.redhat.com/errata/RHSA-2020:0740

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.