ID

VAR-202102-0068

CVE

CVE-2020-12362

TITLE

Red Hat Security Advisory 2021-1739-01

DESCRIPTION

Integer overflow in the firmware for some Intel(R) Graphics Drivers for Windows * before version 26.20.100.7212 and before Linux kernel version 5.5 may allow a privileged user to potentially enable an escalation of privilege via local access. There is a security vulnerability in Intel Graphics Drivers. There is no information about this vulnerability at present. Please pay attention to CNNVD or manufacturer announcements at any time. 8) - x86_64 3. Description: The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. 1895961 - CVE-2020-25704 kernel: perf_event_parse_addr_filter memory 1896842 - host locks up when running stress-ng itimers on RT kernel. 1897869 - Running oslat in RT guest, guest kernel shows Call Trace: INFO: task kcompactd0:35 blocked for more than 600 seconds. 8) - noarch 3. 8.1) - aarch64, noarch, ppc64le, s390x, x86_64 3. Bug Fix(es): * [Regression] RHEL8.2 - ISST-LTE:pVM:diapvmlp83:sum:memory DLPAR fails to add memory on multiple trials[mm/memory_hotplug.c:1163] (mm-) (BZ#1930170) * RHEL8.3 - Include patch: powerpc/pci: Remove LSI mappings on device teardown (xive/pci) (BZ#1931926) * [HPEMC 8.1 REGRESSION] skx_uncore: probe of 0008:80:08.0 failed with error -22 (BZ#1947115) * [Azure][RHEL-8]Mellanox Patches To Prevent Kernel Hang In MLX4 (BZ#1952072) * [HPEMC 8.4 REGRESSION]: perf/x86/intel/uncore kernel panic vulnerability on Haswell and Broadwell servers (BZ#1956686) 4. Description: Red Hat Advanced Cluster Management for Kubernetes 2.2.4 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. See the following Release Notes documentation, which will be updated shortly for this release, for additional details about this release: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_mana gement_for_kubernetes/2.2/html/release_notes/ Security fixes: * redisgraph-tls: redis: integer overflow when configurable limit for maximum supported bulk input size is too big on 32-bit platforms (CVE-2021-21309) * console-header-container: nodejs-netmask: improper input validation of octal input data (CVE-2021-28092) * console-container: nodejs-is-svg: ReDoS via malicious string (CVE-2021-28918) Bug fixes: * RHACM 2.2.4 images (BZ# 1957254) * Enabling observability for OpenShift Container Storage with RHACM 2.2 on OCP 4.7 (BZ#1950832) * ACM Operator should support using the default route TLS (BZ# 1955270) * The scrolling bar for search filter does not work properly (BZ# 1956852) * Limits on Length of MultiClusterObservability Resource Name (BZ# 1959426) * The proxy setup in install-config.yaml is not worked when IPI installing with RHACM (BZ# 1960181) * Unable to make SSH connection to a Bitbucket server (BZ# 1966513) * Observability Thanos store shard crashing - cannot unmarshall DNS message (BZ# 1967890) 3. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. Bugs fixed (https://bugzilla.redhat.com/): 1932634 - CVE-2021-21309 redis: integer overflow when configurable limit for maximum supported bulk input size is too big on 32-bit platforms 1939103 - CVE-2021-28092 nodejs-is-svg: ReDoS via malicious string 1944827 - CVE-2021-28918 nodejs-netmask: improper input validation of octal input data 1950832 - Enabling observability for OpenShift Container Storage with RHACM 2.2 on OCP 4.7 1952150 - [DDF] It would be great to see all the options available for the bucket configuration and which attributes are mandatory 1954506 - [DDF] Table does not contain data about 20 clusters. Now it's difficult to estimate CPU usage with larger clusters 1954535 - Reinstall Submariner - No endpoints found on one cluster 1955270 - ACM Operator should support using the default route TLS 1956852 - The scrolling bar for search filter does not work properly 1957254 - RHACM 2.2.4 images 1959426 - Limits on Length of MultiClusterObservability Resource Name 1960181 - The proxy setup in install-config.yaml is not worked when IPI installing with RHACM. 1963128 - [DDF] Please rename this to "Amazon Elastic Kubernetes Service" 1966513 - Unable to make SSH connection to a Bitbucket server 1967357 - [DDF] When I clicked on this yaml, I get a HTTP 404 error. 1967890 - Observability Thanos store shard crashing - cannot unmarshal DNS message 5. 6 ELS) - i386, s390x, x86_64 3. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: kernel security update Advisory ID: RHSA-2021:2164-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2021:2164 Issue date: 2021-06-01 CVE Names: CVE-2019-19532 CVE-2020-12362 CVE-2020-25211 CVE-2020-25705 CVE-2020-29661 ===================================================================== 1. Summary: An update for kernel is now available for Red Hat Enterprise Linux 7.4 Advanced Update Support, Red Hat Enterprise Linux 7.4 Telco Extended Update Support, and Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Server AUS (v. 7.4) - noarch, x86_64 Red Hat Enterprise Linux Server E4S (v. 7.4) - noarch, ppc64le, x86_64 Red Hat Enterprise Linux Server Optional AUS (v. 7.4) - x86_64 Red Hat Enterprise Linux Server Optional E4S (v. 7.4) - ppc64le, x86_64 Red Hat Enterprise Linux Server Optional TUS (v. 7.4) - x86_64 Red Hat Enterprise Linux Server TUS (v. 7.4) - noarch, x86_64 3. Description: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Integer overflow in Intel(R) Graphics Drivers (CVE-2020-12362) * kernel: Local buffer overflow in ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c (CVE-2020-25211) * kernel: locking issue in drivers/tty/tty_jobctrl.c can lead to an use-after-free (CVE-2020-29661) * kernel: malicious USB devices can lead to multiple out-of-bounds write (CVE-2019-19532) * kernel: ICMP rate limiting can be used for DNS poisoning attack (CVE-2020-25705) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 1781821 - CVE-2019-19532 kernel: malicious USB devices can lead to multiple out-of-bounds write 1877571 - CVE-2020-25211 kernel: Local buffer overflow in ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c 1894579 - CVE-2020-25705 kernel: ICMP rate limiting can be used for DNS poisoning attack 1906525 - CVE-2020-29661 kernel: locking issue in drivers/tty/tty_jobctrl.c can lead to an use-after-free 1930246 - CVE-2020-12362 kernel: Integer overflow in Intel(R) Graphics Drivers 6. Package List: Red Hat Enterprise Linux Server AUS (v. 7.4): Source: kernel-3.10.0-693.87.1.el7.src.rpm noarch: kernel-abi-whitelists-3.10.0-693.87.1.el7.noarch.rpm kernel-doc-3.10.0-693.87.1.el7.noarch.rpm x86_64: kernel-3.10.0-693.87.1.el7.x86_64.rpm kernel-debug-3.10.0-693.87.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-693.87.1.el7.x86_64.rpm kernel-debug-devel-3.10.0-693.87.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-693.87.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-693.87.1.el7.x86_64.rpm kernel-devel-3.10.0-693.87.1.el7.x86_64.rpm kernel-headers-3.10.0-693.87.1.el7.x86_64.rpm kernel-tools-3.10.0-693.87.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-693.87.1.el7.x86_64.rpm kernel-tools-libs-3.10.0-693.87.1.el7.x86_64.rpm perf-3.10.0-693.87.1.el7.x86_64.rpm perf-debuginfo-3.10.0-693.87.1.el7.x86_64.rpm python-perf-3.10.0-693.87.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-693.87.1.el7.x86_64.rpm Red Hat Enterprise Linux Server E4S (v. 7.4): Source: kernel-3.10.0-693.87.1.el7.src.rpm noarch: kernel-abi-whitelists-3.10.0-693.87.1.el7.noarch.rpm kernel-doc-3.10.0-693.87.1.el7.noarch.rpm ppc64le: kernel-3.10.0-693.87.1.el7.ppc64le.rpm kernel-bootwrapper-3.10.0-693.87.1.el7.ppc64le.rpm kernel-debug-3.10.0-693.87.1.el7.ppc64le.rpm kernel-debug-debuginfo-3.10.0-693.87.1.el7.ppc64le.rpm kernel-debuginfo-3.10.0-693.87.1.el7.ppc64le.rpm kernel-debuginfo-common-ppc64le-3.10.0-693.87.1.el7.ppc64le.rpm kernel-devel-3.10.0-693.87.1.el7.ppc64le.rpm kernel-headers-3.10.0-693.87.1.el7.ppc64le.rpm kernel-tools-3.10.0-693.87.1.el7.ppc64le.rpm kernel-tools-debuginfo-3.10.0-693.87.1.el7.ppc64le.rpm kernel-tools-libs-3.10.0-693.87.1.el7.ppc64le.rpm perf-3.10.0-693.87.1.el7.ppc64le.rpm perf-debuginfo-3.10.0-693.87.1.el7.ppc64le.rpm python-perf-3.10.0-693.87.1.el7.ppc64le.rpm python-perf-debuginfo-3.10.0-693.87.1.el7.ppc64le.rpm x86_64: kernel-3.10.0-693.87.1.el7.x86_64.rpm kernel-debug-3.10.0-693.87.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-693.87.1.el7.x86_64.rpm kernel-debug-devel-3.10.0-693.87.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-693.87.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-693.87.1.el7.x86_64.rpm kernel-devel-3.10.0-693.87.1.el7.x86_64.rpm kernel-headers-3.10.0-693.87.1.el7.x86_64.rpm kernel-tools-3.10.0-693.87.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-693.87.1.el7.x86_64.rpm kernel-tools-libs-3.10.0-693.87.1.el7.x86_64.rpm perf-3.10.0-693.87.1.el7.x86_64.rpm perf-debuginfo-3.10.0-693.87.1.el7.x86_64.rpm python-perf-3.10.0-693.87.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-693.87.1.el7.x86_64.rpm Red Hat Enterprise Linux Server TUS (v. 7.4): Source: kernel-3.10.0-693.87.1.el7.src.rpm noarch: kernel-abi-whitelists-3.10.0-693.87.1.el7.noarch.rpm kernel-doc-3.10.0-693.87.1.el7.noarch.rpm x86_64: kernel-3.10.0-693.87.1.el7.x86_64.rpm kernel-debug-3.10.0-693.87.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-693.87.1.el7.x86_64.rpm kernel-debug-devel-3.10.0-693.87.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-693.87.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-693.87.1.el7.x86_64.rpm kernel-devel-3.10.0-693.87.1.el7.x86_64.rpm kernel-headers-3.10.0-693.87.1.el7.x86_64.rpm kernel-tools-3.10.0-693.87.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-693.87.1.el7.x86_64.rpm kernel-tools-libs-3.10.0-693.87.1.el7.x86_64.rpm perf-3.10.0-693.87.1.el7.x86_64.rpm perf-debuginfo-3.10.0-693.87.1.el7.x86_64.rpm python-perf-3.10.0-693.87.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-693.87.1.el7.x86_64.rpm Red Hat Enterprise Linux Server Optional AUS (v. 7.4): x86_64: kernel-debug-debuginfo-3.10.0-693.87.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-693.87.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-693.87.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-693.87.1.el7.x86_64.rpm kernel-tools-libs-devel-3.10.0-693.87.1.el7.x86_64.rpm perf-debuginfo-3.10.0-693.87.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-693.87.1.el7.x86_64.rpm Red Hat Enterprise Linux Server Optional E4S (v. 7.4): ppc64le: kernel-debug-debuginfo-3.10.0-693.87.1.el7.ppc64le.rpm kernel-debug-devel-3.10.0-693.87.1.el7.ppc64le.rpm kernel-debuginfo-3.10.0-693.87.1.el7.ppc64le.rpm kernel-debuginfo-common-ppc64le-3.10.0-693.87.1.el7.ppc64le.rpm kernel-tools-debuginfo-3.10.0-693.87.1.el7.ppc64le.rpm kernel-tools-libs-devel-3.10.0-693.87.1.el7.ppc64le.rpm perf-debuginfo-3.10.0-693.87.1.el7.ppc64le.rpm python-perf-debuginfo-3.10.0-693.87.1.el7.ppc64le.rpm x86_64: kernel-debug-debuginfo-3.10.0-693.87.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-693.87.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-693.87.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-693.87.1.el7.x86_64.rpm kernel-tools-libs-devel-3.10.0-693.87.1.el7.x86_64.rpm perf-debuginfo-3.10.0-693.87.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-693.87.1.el7.x86_64.rpm Red Hat Enterprise Linux Server Optional TUS (v. 7.4): x86_64: kernel-debug-debuginfo-3.10.0-693.87.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-693.87.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-693.87.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-693.87.1.el7.x86_64.rpm kernel-tools-libs-devel-3.10.0-693.87.1.el7.x86_64.rpm perf-debuginfo-3.10.0-693.87.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-693.87.1.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2019-19532 https://access.redhat.com/security/cve/CVE-2020-12362 https://access.redhat.com/security/cve/CVE-2020-25211 https://access.redhat.com/security/cve/CVE-2020-25705 https://access.redhat.com/security/cve/CVE-2020-29661 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYLXzYtzjgjWX9erEAQjW3A//ax5IBIju/37C2l6J5HuZYu5UyI9yyTpC KTB7FRWm+o/Ppr+YR4Tb8WuWtAJwRJgGAIM5jDP+NTHR+PzIua6ei+JtT4nx/1K/ lsylgQDkku4K1ZC9R+235Gj56TKee660vXZ80qWT/M62WkNprdS4XbD01HCAITL0 j1/7cCCSFJfPEUbKGAjk6IgEQrcCo01mrms7Ke6nuqsjKV9JOr6mB8Z+xD5yibg9 23Zkd28mMNgrdzABKuGckrwgucJCGcM34Y0ZVc2fAspk15ei+ELTut4x/fu6Xiqu ZaCB0lR4DmVQpa2tcuqO2iIqgNcYoPxzuMSoyD7DHx0MEbIrXtyYI5YIAmgHeHGg tce2dVFP5UnmW6Zss2kwj4uqh6w/eHrwESdPMbNzsCMj5lV2/TDXDqEwoqaJNNzw kHDjo6+eADy3wavMzRhl2J1kHABCNmwCVn86GC+jyhQ4XObc/oAqkwiF3kLPP7K5 3UROKYWXT6Xy1JGeADaw+Bv7ME772PyKXLN0yFTIgFag/ECwT76OTHbCqwVk0DJJ 72ILUIXscEZ+wwmFULoVZ2D6+1o/+UnttlvsAf3EIme/xLjuOC1wxD4MuR+ypVDn 6dKxgmkR7uL9r/OBrTEQbYAbI3ALAu5B2wSlAxl7Jel606Sd2/iKmFgToZSFEsDC iRLouwDKWC8= =l4Zb -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce . Solution: For OpenShift Container Platform 4.7 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-rel ease-notes.html For Red Hat OpenShift Logging 5.0, see the following instructions to apply this update: https://docs.openshift.com/container-platform/4.7/logging/cluster-logging-u pgrading.html 4. Bugs fixed (https://bugzilla.redhat.com/): 1921650 - CVE-2021-3121 gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation 5. JIRA issues fixed (https://issues.jboss.org/): LOG-1328 - Port fix to 5.0.z for BZ-1945168 6. Bug Fix(es): * memcg: mem_cgroup_idr can be updated in an uncoordinated manner which can lead to corruption (BZ#1931901) * Kernel experiences panic in update_group_power() due to division error even with Bug 1701115 fix (BZ#1961624) 4. Bug Fix(es): * kernel-rt: update RT source tree to the latest RHEL-8.2.z9 Batch source tree (BZ#1949685) 4

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

TYPE

overflow

EXTERNAL IDS

REFERENCES

CREDITS

Red Hat

SOURCES

LAST UPDATE DATE

2024-12-21T19:57:13.874000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE