Red Hat Enterprise Linux 8 update for kernel-rt

1) Information disclosure

EUVDB-ID: #VU25814

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-2732

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to incomplete implementation of vmx_check_intercept on Intel processors in KVM in Linux kernel, which leads to  I/O or MSR interception bitmaps are not checked. A remote attacker with access to guest operating system (e.g. L2 guest) can trick the L0 hypervisor into accessing sensitive information on the L1 hypervisor.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

kernel-rt (Red Hat package): 4.18.0-80.1.2.rt9.145.el8_0 - 4.18.0-147.8.1.rt24.101.el8_1

Red Hat Enterprise Linux for Real Time: 8

CPE2.3

• cpe:2.3:a:red_hat:kernel-rt_redhat_package:4.18.0-80.1.2.rt9.145.el8_0:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:kernel-rt_redhat_package:4.18.0-80.4.2.rt9.152.el8_0:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:kernel-rt_redhat_package:4.18.0-80.7.1.rt9.153.el8_0:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_real_time:8:*:*:*:*:red_hat_enterprise_linux:*:*

External links

https://access.redhat.com/errata/RHSA-2020:2171

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) NULL pointer dereference

EUVDB-ID: #VU28180

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-10711

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in the Linux kernel's SELinux subsystem when importing the Commercial IP Security Option (CIPSO) protocol's category bitmap into the SELinux extensible bitmap via the' ebitmap_netlbl_import' routine. While processing the CIPSO restricted bitmap tag in the 'cipso_v4_parsetag_rbm' routine, it sets the security attribute to indicate that the category bitmap is present, even if it has not been allocated.

A remote attacker can send specially crafted packets the affected system, trigger a NULL pointer dereference error and crash the Linux kernel.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

kernel-rt (Red Hat package): 4.18.0-80.1.2.rt9.145.el8_0 - 4.18.0-147.8.1.rt24.101.el8_1

Red Hat Enterprise Linux for Real Time: 8

CPE2.3

• cpe:2.3:a:red_hat:kernel-rt_redhat_package:4.18.0-80.1.2.rt9.145.el8_0:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:kernel-rt_redhat_package:4.18.0-80.4.2.rt9.152.el8_0:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:kernel-rt_redhat_package:4.18.0-80.7.1.rt9.153.el8_0:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_real_time:8:*:*:*:*:red_hat_enterprise_linux:*:*

External links

https://access.redhat.com/errata/RHSA-2020:2171

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.