RHEL 7 : kernel (RHSA-2017:2473)

This script is Copyright (C) 2017 Tenable Network Security, Inc.


Synopsis :

The remote Red Hat host is missing one or more security updates.

Description :

An update for kernel is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security
impact of Important. A Common Vulnerability Scoring System (CVSS) base
score, which gives a detailed severity rating, is available for each
vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux
operating system.

Security Fix(es) :

* A race condition was found in the Linux kernel, present since
v3.14-rc1 through v4.12. The race happens between threads of
inotify_handle_event() and vfs_rename() while running the rename
operation against the same file. As a result of the race the next slab
data or the slab's free list pointer can be corrupted with
attacker-controlled data. (CVE-2017-7533, Important)

Red Hat would like to thank Leilei Lin (Alibaba Group), Fan Wu (The
University of Hong Kong), and Shixiong Zhao (The University of Hong
Kong) for reporting this issue.

Bug Fix(es) :

* Previously, direct I/O read operations going past EOF returned an
invalid error number, instead of reading 0 bytes and returning
success, if these operations were in same XFS block with EOF.
Consequently, creating multiple VMs from a Red Hat Enterprise Linux
7.4 template caused all the VMs to become unresponsive in the 'Image
Locked' state. This update fixes the direct I/O feature of the file
system, and VMs created from a Red Hat Enterprise Linux 7.4 template
now work as expected. (BZ#1475669)

See also :

http://rhn.redhat.com/errata/RHSA-2017-2473.html
https://www.redhat.com/security/data/cve/CVE-2017-7533.html

Solution :

Update the affected packages.

Risk factor :

Medium / CVSS Base Score : 6.9
(CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 5.7
(CVSS2#E:F/RL:OF/RC:ND)
Public Exploit Available : true

Family: Red Hat Local Security Checks

Nessus Plugin ID: 102518 ()

Bugtraq ID:

CVE ID: CVE-2017-7533

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now