【CESA-2017:0933】最新バージョンのkernelが、Red Hat Enterprise Linux 7 からご利用いただけるようになりました

CESA-2017:0933

最新バージョンのkernelが、Red Hat Enterprise Linux 7 からご利用いただけるようになりました。

Red Hat製品のセキュリティ及び品質は大変ご好評いただいております。

今回の最新バージョンVulnerability Scoring System(CVSS)は、各セキュリティホールへのアクセス安全面を厳重にクラス分けし、確実・安全に詳細レポートをお送りいたします。参照セクションのリンクをクリックしてください。

The kernel packages contain the Linux kernel, the core of any Linux operating
system.

These updated kernel packages include several security issues and numerous bug
fixes. Space precludes documenting all of these bug fixes in this advisory. To
see the complete list of bug fixes, users are directed to the related Knowledge
Article: https://access.redhat.com/articles/2986951.

Security Fix(es):

* A race condition flaw was found in the N_HLDC Linux kernel driver when
accessing n_hdlc.tbuf list that can lead to double free. A local, unprivileged
user able to set the HDLC line discipline on the tty device could use this flaw
to increase their privileges on the system. (CVE-2017-2636, Important)

* A flaw was found in the Linux kernel key management subsystem in which a local
attacker could crash the kernel or corrupt the stack and additional memory
(denial of service) by supplying a specially crafted RSA key. This flaw panics
the machine during the verification of the RSA key. (CVE-2016-8650, Moderate)

* A flaw was found in the Linux kernel’s implementation of setsockopt for the
SO_{SND|RCV}BUFFORCE setsockopt() system call. Users with non-namespace
CAP_NET_ADMIN are able to trigger this call and create a situation in which the
sockets sendbuff data size could be negative. This could adversely affect memory
allocations and create situations where the system could crash or cause memory
corruption. (CVE-2016-9793, Moderate)

* A flaw was found in the Linux kernel’s handling of clearing SELinux attributes
on /proc/pid/attr files. An empty (null) write to this file can crash the system
by causing the system to attempt to access unmapped kernel memory.
(CVE-2017-2618, Moderate)

Red Hat would like to thank Alexander Popov for reporting CVE-2017-2636 and Ralf
Spenneberg for reporting CVE-2016-8650. The CVE-2017-2618 issue was discovered
by Paul Moore (Red Hat Engineering).

Bugs Fixed

1395187 – CVE-2016-8650 kernel: Null pointer dereference via keyctl
1402013 – CVE-2016-9793 kernel: Signed overflow for SO_{SND|RCV}BUFFORCE
1419916 – CVE-2017-2618 kernel: Off-by-one error in selinux_setprocattr (/proc/self/attr/fscreate)
1428319 – CVE-2017-2636 kernel: Race condition access to n_hdlc.tbuf causes double free in n_hdlc_release()