ID

VAR-201805-0963

CVE

CVE-2018-3639

TITLE

CPU hardware utilizing speculative execution may be vulnerable to cache side-channel attacks

DESCRIPTION

Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4. CPU hardware utilizing speculative execution may be vulnerable to cache timing side-channel analysis. Two vulnerabilities are identified, known as "Variant 3a" and "Variant 4". CPUhardware is firmware that runs in the central processor for managing and controlling the CPU. Multiple CPUHardware information disclosure vulnerabilities. The vulnerability is caused by a race condition in the CPU cache processing. Local attackers can exploit vulnerabilities to obtain sensitive information through side channel analysis. AMD, ARM, and Intel CPUs are all CPU (central processing unit) products from different manufacturers. AMD, ARM, and Intel CPUs have security vulnerabilities. Description: The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: kernel security and bug fix update Advisory ID: RHSA-2018:1854-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2018:1854 Issue date: 2018-06-19 CVE Names: CVE-2012-6701 CVE-2015-8830 CVE-2016-8650 CVE-2017-2671 CVE-2017-6001 CVE-2017-7308 CVE-2017-7616 CVE-2017-7889 CVE-2017-8890 CVE-2017-9075 CVE-2017-9076 CVE-2017-9077 CVE-2017-12190 CVE-2017-15121 CVE-2017-18203 CVE-2018-1130 CVE-2018-3639 CVE-2018-5803 ===================================================================== 1. Summary: An update for kernel is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 6) - i386, noarch, x86_64 Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux HPC Node (v. 6) - noarch, x86_64 Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, noarch, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, noarch, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64 3. Description: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions (a commonly used performance optimization). It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory read from address to which a recent memory write has occurred may see an older value and subsequently cause an update into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to read privileged memory by conducting targeted cache side-channel attacks. (CVE-2018-3639, PowerPC) * kernel: net/packet: overflow in check for priv area size (CVE-2017-7308) * kernel: AIO interface didn't use rw_verify_area() for checking mandatory locking on files and size of access (CVE-2012-6701) * kernel: AIO write triggers integer overflow in some protocols (CVE-2015-8830) * kernel: Null pointer dereference via keyctl (CVE-2016-8650) * kernel: ping socket / AF_LLC connect() sin_family race (CVE-2017-2671) * kernel: Race condition between multiple sys_perf_event_open() calls (CVE-2017-6001) * kernel: Incorrect error handling in the set_mempolicy and mbind compat syscalls in mm/mempolicy.c (CVE-2017-7616) * kernel: mm subsystem does not properly enforce the CONFIG_STRICT_DEVMEM protection mechanism (CVE-2017-7889) * kernel: Double free in the inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c (CVE-2017-8890) * kernel: net: sctp_v6_create_accept_sk function mishandles inheritance (CVE-2017-9075) * kernel: net: IPv6 DCCP implementation mishandles inheritance (CVE-2017-9076) * kernel: net: tcp_v6_syn_recv_sock function mishandles inheritance (CVE-2017-9077) * kernel: memory leak when merging buffers in SCSI IO vectors (CVE-2017-12190) * kernel: vfs: BUG in truncate_inode_pages_range() and fuse client (CVE-2017-15121) * kernel: Race condition in drivers/md/dm.c:dm_get_from_kobject() allows local users to cause a denial of service (CVE-2017-18203) * kernel: a null pointer dereference in net/dccp/output.c:dccp_write_xmit() leads to a system crash (CVE-2018-1130) * kernel: Missing length check of payload in net/sctp/sm_make_chunk.c:_sctp_make_chunk() function allows denial of service (CVE-2018-5803) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank Ken Johnson (Microsoft Security Response Center) and Jann Horn (Google Project Zero) for reporting CVE-2018-3639; Vitaly Mayatskih for reporting CVE-2017-12190; and Evgenii Shatokhin (Virtuozzo Team) for reporting CVE-2018-1130. The CVE-2017-15121 issue was discovered by Miklos Szeredi (Red Hat). Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 6.10 Release Notes and Red Hat Enterprise Linux 6.10 Technical Notes linked from the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 869942 - Kernel crashes on reading an ACL containing 190 ACEs over NFSv4 1314275 - CVE-2015-8830 kernel: AIO write triggers integer overflow in some protocols 1314288 - CVE-2012-6701 kernel: AIO interface didn't use rw_verify_area() for checking mandatory locking on files and size of access 1395187 - CVE-2016-8650 kernel: Null pointer dereference via keyctl 1422825 - CVE-2017-6001 kernel: Race condition between multiple sys_perf_event_open() calls 1436649 - CVE-2017-2671 kernel: ping socket / AF_LLC connect() sin_family race 1437404 - CVE-2017-7308 kernel: net/packet: overflow in check for priv area size 1441088 - CVE-2017-7616 kernel: Incorrect error handling in the set_mempolicy and mbind compat syscalls in mm/mempolicy.c 1444493 - CVE-2017-7889 kernel: mm subsystem does not properly enforce the CONFIG_STRICT_DEVMEM protection mechanism 1448170 - RHEL6.9: sunrpc reconnect logic now may trigger a SYN storm when a TCP connection drops and a burst of RPC commands hit the transport 1450972 - CVE-2017-8890 kernel: Double free in the inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c 1452688 - CVE-2017-9076 kernel: net: IPv6 DCCP implementation mishandles inheritance 1452691 - CVE-2017-9075 kernel: net: sctp_v6_create_accept_sk function mishandles inheritance 1452744 - CVE-2017-9077 kernel: net: tcp_v6_syn_recv_sock function mishandles inheritance 1495089 - CVE-2017-12190 kernel: memory leak when merging buffers in SCSI IO vectors 1497152 - systool causes panic on 2.6.32-696.6.3.el6.x86_64 using be2iscsi 1520893 - CVE-2017-15121 kernel: vfs: BUG in truncate_inode_pages_range() and fuse client 1550811 - CVE-2017-18203 kernel: Race condition in drivers/md/dm.c:dm_get_from_kobject() allows local users to cause a denial of service 1551051 - CVE-2018-5803 kernel: Missing length check of payload in net/sctp/sm_make_chunk.c:_sctp_make_chunk() function allows denial of service 1560494 - i686: Using invpcid_flush_all_nonglobals() can cause user-space panic on .i686 1566890 - CVE-2018-3639 hw: cpu: speculative store bypass 1576419 - CVE-2018-1130 kernel: a null pointer dereference in net/dccp/output.c:dccp_write_xmit() leads to a system crash 6. Package List: Red Hat Enterprise Linux Desktop (v. 6): Source: kernel-2.6.32-754.el6.src.rpm i386: kernel-2.6.32-754.el6.i686.rpm kernel-debug-2.6.32-754.el6.i686.rpm kernel-debug-debuginfo-2.6.32-754.el6.i686.rpm kernel-debug-devel-2.6.32-754.el6.i686.rpm kernel-debuginfo-2.6.32-754.el6.i686.rpm kernel-debuginfo-common-i686-2.6.32-754.el6.i686.rpm kernel-devel-2.6.32-754.el6.i686.rpm kernel-headers-2.6.32-754.el6.i686.rpm perf-2.6.32-754.el6.i686.rpm perf-debuginfo-2.6.32-754.el6.i686.rpm python-perf-debuginfo-2.6.32-754.el6.i686.rpm noarch: kernel-abi-whitelists-2.6.32-754.el6.noarch.rpm kernel-doc-2.6.32-754.el6.noarch.rpm kernel-firmware-2.6.32-754.el6.noarch.rpm x86_64: kernel-2.6.32-754.el6.x86_64.rpm kernel-debug-2.6.32-754.el6.x86_64.rpm kernel-debug-debuginfo-2.6.32-754.el6.i686.rpm kernel-debug-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debug-devel-2.6.32-754.el6.i686.rpm kernel-debug-devel-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-2.6.32-754.el6.i686.rpm kernel-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-common-i686-2.6.32-754.el6.i686.rpm kernel-debuginfo-common-x86_64-2.6.32-754.el6.x86_64.rpm kernel-devel-2.6.32-754.el6.x86_64.rpm kernel-headers-2.6.32-754.el6.x86_64.rpm perf-2.6.32-754.el6.x86_64.rpm perf-debuginfo-2.6.32-754.el6.i686.rpm perf-debuginfo-2.6.32-754.el6.x86_64.rpm python-perf-debuginfo-2.6.32-754.el6.i686.rpm python-perf-debuginfo-2.6.32-754.el6.x86_64.rpm Red Hat Enterprise Linux Desktop Optional (v. 6): i386: kernel-debug-debuginfo-2.6.32-754.el6.i686.rpm kernel-debuginfo-2.6.32-754.el6.i686.rpm kernel-debuginfo-common-i686-2.6.32-754.el6.i686.rpm perf-debuginfo-2.6.32-754.el6.i686.rpm python-perf-2.6.32-754.el6.i686.rpm python-perf-debuginfo-2.6.32-754.el6.i686.rpm x86_64: kernel-debug-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-common-x86_64-2.6.32-754.el6.x86_64.rpm perf-debuginfo-2.6.32-754.el6.x86_64.rpm python-perf-2.6.32-754.el6.x86_64.rpm python-perf-debuginfo-2.6.32-754.el6.x86_64.rpm Red Hat Enterprise Linux HPC Node (v. 6): Source: kernel-2.6.32-754.el6.src.rpm noarch: kernel-abi-whitelists-2.6.32-754.el6.noarch.rpm kernel-doc-2.6.32-754.el6.noarch.rpm kernel-firmware-2.6.32-754.el6.noarch.rpm x86_64: kernel-2.6.32-754.el6.x86_64.rpm kernel-debug-2.6.32-754.el6.x86_64.rpm kernel-debug-debuginfo-2.6.32-754.el6.i686.rpm kernel-debug-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debug-devel-2.6.32-754.el6.i686.rpm kernel-debug-devel-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-2.6.32-754.el6.i686.rpm kernel-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-common-i686-2.6.32-754.el6.i686.rpm kernel-debuginfo-common-x86_64-2.6.32-754.el6.x86_64.rpm kernel-devel-2.6.32-754.el6.x86_64.rpm kernel-headers-2.6.32-754.el6.x86_64.rpm perf-2.6.32-754.el6.x86_64.rpm perf-debuginfo-2.6.32-754.el6.i686.rpm perf-debuginfo-2.6.32-754.el6.x86_64.rpm python-perf-debuginfo-2.6.32-754.el6.i686.rpm python-perf-debuginfo-2.6.32-754.el6.x86_64.rpm Red Hat Enterprise Linux HPC Node Optional (v. 6): x86_64: kernel-debug-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-common-x86_64-2.6.32-754.el6.x86_64.rpm perf-debuginfo-2.6.32-754.el6.x86_64.rpm python-perf-2.6.32-754.el6.x86_64.rpm python-perf-debuginfo-2.6.32-754.el6.x86_64.rpm Red Hat Enterprise Linux Server (v. 6): Source: kernel-2.6.32-754.el6.src.rpm i386: kernel-2.6.32-754.el6.i686.rpm kernel-debug-2.6.32-754.el6.i686.rpm kernel-debug-debuginfo-2.6.32-754.el6.i686.rpm kernel-debug-devel-2.6.32-754.el6.i686.rpm kernel-debuginfo-2.6.32-754.el6.i686.rpm kernel-debuginfo-common-i686-2.6.32-754.el6.i686.rpm kernel-devel-2.6.32-754.el6.i686.rpm kernel-headers-2.6.32-754.el6.i686.rpm perf-2.6.32-754.el6.i686.rpm perf-debuginfo-2.6.32-754.el6.i686.rpm python-perf-debuginfo-2.6.32-754.el6.i686.rpm noarch: kernel-abi-whitelists-2.6.32-754.el6.noarch.rpm kernel-doc-2.6.32-754.el6.noarch.rpm kernel-firmware-2.6.32-754.el6.noarch.rpm ppc64: kernel-2.6.32-754.el6.ppc64.rpm kernel-bootwrapper-2.6.32-754.el6.ppc64.rpm kernel-debug-2.6.32-754.el6.ppc64.rpm kernel-debug-debuginfo-2.6.32-754.el6.ppc64.rpm kernel-debug-devel-2.6.32-754.el6.ppc64.rpm kernel-debuginfo-2.6.32-754.el6.ppc64.rpm kernel-debuginfo-common-ppc64-2.6.32-754.el6.ppc64.rpm kernel-devel-2.6.32-754.el6.ppc64.rpm kernel-headers-2.6.32-754.el6.ppc64.rpm perf-2.6.32-754.el6.ppc64.rpm perf-debuginfo-2.6.32-754.el6.ppc64.rpm python-perf-debuginfo-2.6.32-754.el6.ppc64.rpm s390x: kernel-2.6.32-754.el6.s390x.rpm kernel-debug-2.6.32-754.el6.s390x.rpm kernel-debug-debuginfo-2.6.32-754.el6.s390x.rpm kernel-debug-devel-2.6.32-754.el6.s390x.rpm kernel-debuginfo-2.6.32-754.el6.s390x.rpm kernel-debuginfo-common-s390x-2.6.32-754.el6.s390x.rpm kernel-devel-2.6.32-754.el6.s390x.rpm kernel-headers-2.6.32-754.el6.s390x.rpm kernel-kdump-2.6.32-754.el6.s390x.rpm kernel-kdump-debuginfo-2.6.32-754.el6.s390x.rpm kernel-kdump-devel-2.6.32-754.el6.s390x.rpm perf-2.6.32-754.el6.s390x.rpm perf-debuginfo-2.6.32-754.el6.s390x.rpm python-perf-debuginfo-2.6.32-754.el6.s390x.rpm x86_64: kernel-2.6.32-754.el6.x86_64.rpm kernel-debug-2.6.32-754.el6.x86_64.rpm kernel-debug-debuginfo-2.6.32-754.el6.i686.rpm kernel-debug-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debug-devel-2.6.32-754.el6.i686.rpm kernel-debug-devel-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-2.6.32-754.el6.i686.rpm kernel-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-common-i686-2.6.32-754.el6.i686.rpm kernel-debuginfo-common-x86_64-2.6.32-754.el6.x86_64.rpm kernel-devel-2.6.32-754.el6.x86_64.rpm kernel-headers-2.6.32-754.el6.x86_64.rpm perf-2.6.32-754.el6.x86_64.rpm perf-debuginfo-2.6.32-754.el6.i686.rpm perf-debuginfo-2.6.32-754.el6.x86_64.rpm python-perf-debuginfo-2.6.32-754.el6.i686.rpm python-perf-debuginfo-2.6.32-754.el6.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 6): i386: kernel-debug-debuginfo-2.6.32-754.el6.i686.rpm kernel-debuginfo-2.6.32-754.el6.i686.rpm kernel-debuginfo-common-i686-2.6.32-754.el6.i686.rpm perf-debuginfo-2.6.32-754.el6.i686.rpm python-perf-2.6.32-754.el6.i686.rpm python-perf-debuginfo-2.6.32-754.el6.i686.rpm ppc64: kernel-debug-debuginfo-2.6.32-754.el6.ppc64.rpm kernel-debuginfo-2.6.32-754.el6.ppc64.rpm kernel-debuginfo-common-ppc64-2.6.32-754.el6.ppc64.rpm perf-debuginfo-2.6.32-754.el6.ppc64.rpm python-perf-2.6.32-754.el6.ppc64.rpm python-perf-debuginfo-2.6.32-754.el6.ppc64.rpm s390x: kernel-debug-debuginfo-2.6.32-754.el6.s390x.rpm kernel-debuginfo-2.6.32-754.el6.s390x.rpm kernel-debuginfo-common-s390x-2.6.32-754.el6.s390x.rpm kernel-kdump-debuginfo-2.6.32-754.el6.s390x.rpm perf-debuginfo-2.6.32-754.el6.s390x.rpm python-perf-2.6.32-754.el6.s390x.rpm python-perf-debuginfo-2.6.32-754.el6.s390x.rpm x86_64: kernel-debug-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-common-x86_64-2.6.32-754.el6.x86_64.rpm perf-debuginfo-2.6.32-754.el6.x86_64.rpm python-perf-2.6.32-754.el6.x86_64.rpm python-perf-debuginfo-2.6.32-754.el6.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 6): Source: kernel-2.6.32-754.el6.src.rpm i386: kernel-2.6.32-754.el6.i686.rpm kernel-debug-2.6.32-754.el6.i686.rpm kernel-debug-debuginfo-2.6.32-754.el6.i686.rpm kernel-debug-devel-2.6.32-754.el6.i686.rpm kernel-debuginfo-2.6.32-754.el6.i686.rpm kernel-debuginfo-common-i686-2.6.32-754.el6.i686.rpm kernel-devel-2.6.32-754.el6.i686.rpm kernel-headers-2.6.32-754.el6.i686.rpm perf-2.6.32-754.el6.i686.rpm perf-debuginfo-2.6.32-754.el6.i686.rpm python-perf-debuginfo-2.6.32-754.el6.i686.rpm noarch: kernel-abi-whitelists-2.6.32-754.el6.noarch.rpm kernel-doc-2.6.32-754.el6.noarch.rpm kernel-firmware-2.6.32-754.el6.noarch.rpm x86_64: kernel-2.6.32-754.el6.x86_64.rpm kernel-debug-2.6.32-754.el6.x86_64.rpm kernel-debug-debuginfo-2.6.32-754.el6.i686.rpm kernel-debug-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debug-devel-2.6.32-754.el6.i686.rpm kernel-debug-devel-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-2.6.32-754.el6.i686.rpm kernel-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-common-i686-2.6.32-754.el6.i686.rpm kernel-debuginfo-common-x86_64-2.6.32-754.el6.x86_64.rpm kernel-devel-2.6.32-754.el6.x86_64.rpm kernel-headers-2.6.32-754.el6.x86_64.rpm perf-2.6.32-754.el6.x86_64.rpm perf-debuginfo-2.6.32-754.el6.i686.rpm perf-debuginfo-2.6.32-754.el6.x86_64.rpm python-perf-debuginfo-2.6.32-754.el6.i686.rpm python-perf-debuginfo-2.6.32-754.el6.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 6): i386: kernel-debug-debuginfo-2.6.32-754.el6.i686.rpm kernel-debuginfo-2.6.32-754.el6.i686.rpm kernel-debuginfo-common-i686-2.6.32-754.el6.i686.rpm perf-debuginfo-2.6.32-754.el6.i686.rpm python-perf-2.6.32-754.el6.i686.rpm python-perf-debuginfo-2.6.32-754.el6.i686.rpm x86_64: kernel-debug-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-common-x86_64-2.6.32-754.el6.x86_64.rpm perf-debuginfo-2.6.32-754.el6.x86_64.rpm python-perf-2.6.32-754.el6.x86_64.rpm python-perf-debuginfo-2.6.32-754.el6.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2012-6701 https://access.redhat.com/security/cve/CVE-2015-8830 https://access.redhat.com/security/cve/CVE-2016-8650 https://access.redhat.com/security/cve/CVE-2017-2671 https://access.redhat.com/security/cve/CVE-2017-6001 https://access.redhat.com/security/cve/CVE-2017-7308 https://access.redhat.com/security/cve/CVE-2017-7616 https://access.redhat.com/security/cve/CVE-2017-7889 https://access.redhat.com/security/cve/CVE-2017-8890 https://access.redhat.com/security/cve/CVE-2017-9075 https://access.redhat.com/security/cve/CVE-2017-9076 https://access.redhat.com/security/cve/CVE-2017-9077 https://access.redhat.com/security/cve/CVE-2017-12190 https://access.redhat.com/security/cve/CVE-2017-15121 https://access.redhat.com/security/cve/CVE-2017-18203 https://access.redhat.com/security/cve/CVE-2018-1130 https://access.redhat.com/security/cve/CVE-2018-3639 https://access.redhat.com/security/cve/CVE-2018-5803 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/security/vulnerabilities/ssbd https://access.redhat.com/documentation/en-US/red_hat_enterprise_linux/6/html/6.10_release_notes/index.html https://access.redhat.com/documentation/en-US/red_hat_enterprise_linux/6/html/6.10_technical_notes/index.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2018 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBWyiNN9zjgjWX9erEAQgn7g/8DeDvxkh3SCpVN2ma5SLYXBnG5pss2Qp7 P5a5zLae8g0OjnZMg2LoCC+Qk0Fe4mpXKB3Wu4yZmRNs7Y5WRWa4imP7ZYvLiSKa KMXLcJhZBMN16ICFw2YX9rN3+wnRC94XY9cW5x0x2uJXoBOMb0MvccLE9z5DIZ7s KI03p2JEHLMt60oZVK6Vdcs+RbfoKLgh3Z2C2ryybjl3LGO+YcqCLvDgsvXnOJl8 TBZRBBd/X6V3xld3x0N3qgPOc4uRXQuqH/QmELZAhcc0MdyhTDQV6JZsYBMV2w5n T0lo71xuPJxLZvMt8UXkQwsCWIuFMQk8uyV6mV+peXxUS0y2LUY2uwWs1AXWOUxx FfYm0jAsZW8kTLZfag9w2zWREib8bs0sx44Etz0HBs+dMHLZc7j6PvTk3zyFijSC qqk+AFGnvM76cQmP8m/SxzEr0YV5FH1wp0eJ/mdn4tl42OBu7Zu7joTI04n6DFsg 1tP5a+46eb8bFLI3FjvoN/Z3Qyaln27tVhFpTY88f3lonDDlFo8BkWNG038JxGRk R6Wjln6724pFfBT9vj+/RQFpSptFKXL3h4Fd/x+XNTFbx1dqpnVaVsstRDxOaqPO ugnRxLgzybXC1UQO0ExMu85jUM3QYLKFSv/G1dHhSsbfbOfnfbPaazpoAvClfWw5 FIbNr61v/A8= =BnkQ -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . Issue date: 2018-05-21 Updated on: 2018-05-21 (Initial Advisory) CVE number: CVE-2018-3639 1. Summary VMware vSphere, Workstation and Fusion updates enable Hypervisor- Assisted Guest Mitigations for Speculative Store Bypass issue. The mitigations in this advisory are categorized as Hypervisor Assisted Guest Mitigations described by VMware Knowledge Base article 54951. KB54951 also covers CVE-2018-3640 mitigations which do not require VMware product updates. Relevant Products VMware vCenter Server (VC) VMware vSphere ESXi (ESXi) VMware Workstation Pro / Player (Workstation) VMware Fusion Pro / Fusion (Fusion) 3. Problem Description vCenter Server, ESXi, Workstation, and Fusion update speculative execution control mechanism for Virtual Machines (VMs). As a result, a patched Guest Operating System (GOS) can remediate the Speculative Store bypass issue (CVE-2018-3639) using the Speculative-Store- Bypass-Disable (SSBD) control bit. This issue may allow for information disclosure in applications and/or execution runtimes which rely on managed code security mechanisms. Based on current evaluations, we do not believe that CVE-2018-3639 could allow for VM to VM or Hypervisor to VM Information disclosure. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2018-3639 to this issue. Column 5 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available. VMware Product Running Replace with/ Mitigation/ Product Version on Severity Apply Patch Workaround =========== ========= ======= ========= ================= ========== VC 6.7 Any Moderate Patch Pending* None VC 6.5 Any Moderate Patch Pending* None VC 6.0 Any Moderate Patch Pending* None VC 5.5 Any Moderate Patch Pending* None ESXi 6.7 Any Moderate Patch Pending* None ESXi 6.5 Any Moderate Patch Pending* None ESXi 6.0 Any Moderate Patch Pending* None ESXi 5.5 Any Moderate Patch Pending* None Workstation 14.x Any Moderate 14.1.2** None Fusion 10.x Any Moderate 10.1.2** None *These updates are on hold until Intel has released updated microcode which has been tested by VMware. **There are additional VMware and 3rd party requirements for CVE-2018-3639 mitigation beyond applying these updates. Please see VMware Knowledge Base Article 55111 for details. Solution VMware Workstation Pro, Player 14.1.2 Downloads and Documentation: https://www.vmware.com/go/downloadworkstation https://www.vmware.com/go/downloadplayer VMware Fusion Pro / Fusion 10.1.2 Downloads and Documentation: https://www.vmware.com/go/downloadfusion 5. Change log 2018-05-21: Initial security advisory in conjunction with the release of Workstation 14.1.2 and Fusion 10.1.2 on 2018-05-21. Contact E-mail list for product security notifications and announcements: http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce This Security Advisory is posted to the following lists: security-announce@lists.vmware.com bugtraq@securityfocus.com fulldisclosure@seclists.org E-mail: security at vmware.com PGP key at: https://kb.vmware.com/kb/1055 VMware Security Advisories http://www.vmware.com/security/advisories VMware Security Response Policy https://www.vmware.com/support/policies/security_response.html VMware Lifecycle Support Phases https://www.vmware.com/support/policies/lifecycle.html VMware Security & Compliance Blog https://blogs.vmware.com/security Twitter https://twitter.com/VMwareSRC Copyright 2018 VMware Inc. All rights reserved. Description: KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products. Bug Fix(es): * Previously, using device passthrough for a SCSI-2 device failed and returned an "Illegal Request" error. With this update, the QEMU emulator checks the SCSI version of the device when performing passthrough. (BZ#1571370) * Under certain circumstances, resuming a paused guest generated redundant "VIR_DOMAIN_PAUSED_UNKNOWN" error messages in the libvirt log. This update corrects the event sending order when resuming guests, which prevents the errors being logged. (BZ#1588001) 4. Once all virtual machines have shut down, start them again for this update to take effect. 6.6) - x86_64 3. Description: The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems. (CVE-2018-3639 virt-ssbd AMD) Note: This is the libvirt side of the CVE-2018-3639 mitigation. 6.6) - noarch, x86_64 3. The updated kernel packages provide software side of the mitigation for this hardware issue. To be fully functional, up-to-date CPU microcode applied on the system is required. Please refer to References section for further information about this issue, CPU microcode requirements and the potential performance impact. Bug Fix(es): * If the cifs_reopen_file() function failed to find a file, the pointer to the cifsFileInfo structure was not reinitialized by being set to "NULL". Subsequently, the find_writable_file() function used an invalid pointer to cifsFileInfo. Consequently, the operating system terminated unexpectedly. With this update, the underlying source code has been fixed to reinitialize the pointer to cifsFileInfo as expected. As a result, the operating system no longer crashes due to this bug. (BZ#1577086) 4. Bugs fixed (https://bugzilla.redhat.com/): 1566890 - CVE-2018-3639 hw: cpu: speculative store bypass 6. ========================================================================== Ubuntu Security Notice USN-3654-1 May 22, 2018 linux, linux-aws, linux-kvm, vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 LTS Summary: Several security issues were addressed in the Linux kernel. (CVE-2018-3639) Tuba Yavuz discovered that a double-free error existed in the USBTV007 driver of the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-17975) It was discovered that a race condition existed in the F2FS implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2017-18193) It was discovered that a buffer overflow existed in the Hisilicon HNS Ethernet Device driver in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-18222) It was discovered that the netfilter subsystem in the Linux kernel did not validate that rules containing jumps contained user-defined chains. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-1065) It was discovered that the netfilter subsystem of the Linux kernel did not properly validate ebtables offsets. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-1068) It was discovered that a null pointer dereference vulnerability existed in the DCCP protocol implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2018-1130) It was discovered that the SCTP Protocol implementation in the Linux kernel did not properly validate userspace provided payload lengths in some situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2018-5803) It was discovered that a double free error existed in the block layer subsystem of the Linux kernel when setting up a request queue. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-7480) It was discovered that a memory leak existed in the SAS driver subsystem of the Linux kernel. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2018-7757) It was discovered that a race condition existed in the x86 machine check handler in the Linux kernel. A local privileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-7995) Eyal Itkin discovered that the USB displaylink video adapter driver in the Linux kernel did not properly validate mmap offsets sent from userspace. (CVE-2018-8781) Silvio Cesare discovered a buffer overwrite existed in the NCPFS implementation in the Linux kernel. A remote attacker controlling a malicious NCPFS server could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-8822) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 LTS: linux-image-4.4.0-1026-kvm 4.4.0-1026.31 linux-image-4.4.0-1060-aws 4.4.0-1060.69 linux-image-4.4.0-127-generic 4.4.0-127.153 linux-image-4.4.0-127-generic-lpae 4.4.0-127.153 linux-image-4.4.0-127-lowlatency 4.4.0-127.153 linux-image-4.4.0-127-powerpc-e500mc 4.4.0-127.153 linux-image-4.4.0-127-powerpc-smp 4.4.0-127.153 linux-image-4.4.0-127-powerpc64-emb 4.4.0-127.153 linux-image-4.4.0-127-powerpc64-smp 4.4.0-127.153 linux-image-aws 4.4.0.1060.62 linux-image-generic 4.4.0.127.133 linux-image-generic-lpae 4.4.0.127.133 linux-image-kvm 4.4.0.1026.25 linux-image-lowlatency 4.4.0.127.133 linux-image-powerpc-e500mc 4.4.0.127.133 linux-image-powerpc-smp 4.4.0.127.133 linux-image-powerpc64-emb 4.4.0.127.133 linux-image-powerpc64-smp 4.4.0.127.133 Please note that fully mitigating CVE-2018-3639 (Spectre Variant 4) may require corresponding processor microcode/firmware updates or, in virtual environments, hypervisor updates. On i386 and amd64 architectures, the SSBD feature is required to enable the kernel mitigations. BIOS vendors will be making updates available for Intel processors that implement SSBD and Ubuntu is working with Intel to provide future microcode updates. Ubuntu users with a processor from a different vendor should contact the vendor to identify necessary firmware updates. Ubuntu provided corresponding QEMU updates for users of self-hosted virtual environments in USN 3651-1. Ubuntu users in cloud environments should contact the cloud provider to confirm that the hypervisor has been updated to expose the new CPU features to virtual machines

IOT TAXONOMY

AFFECTED PRODUCTS