RHEL 7 : kernel (RHSA-2017:0501)

This script is Copyright (C) 2017 Tenable Network Security, Inc.


Synopsis :

The remote Red Hat host is missing one or more security updates.

Description :

An update for kernel is now available for Red Hat Enterprise Linux 7.2
Extended Update Support.

Red Hat Product Security has rated this update as having a security
impact of Important. A Common Vulnerability Scoring System (CVSS) base
score, which gives a detailed severity rating, is available for each
vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux
operating system.

Security Fix(es) :

* A use-after-free flaw was found in the way the Linux kernel's
Datagram Congestion Control Protocol (DCCP) implementation freed SKB
(socket buffer) resources for a DCCP_PKT_REQUEST packet when the
IPV6_RECVPKTINFO option is set on the socket. A local, unprivileged
user could use this flaw to alter the kernel memory, allowing them to
escalate their privileges on the system. (CVE-2017-6074, Important)

Red Hat would like to thank Andrey Konovalov (Google) for reporting
this issue.

Bug Fix(es) :

* Previously, running the 'ethtool -S' command to get the statistics
of a Brocade Network Adapter (BNA) sometimes caused a kernel panic.
This update applies a set of patches to the bna driver, and the kernel
panic no longer occurs in the described scenario. (BZ#1408130)

* Use of a multi-threaded workload with high memory mappings sometimes
caused a kernel panic, due to a race condition between the context
switch and the pagetable upgrade. This update fixes the switch_mm() by
using the complete asce parameter instead of the asce_bits parameter.
As a result, the kernel no longer panics in the described scenario.
(BZ#1410865)

* Previously, the kernel was sending a Transmission Control Protocol
(TCP) window which had a size of zero for a socket with an empty
receive queue. Consequently, the TCP session became unresponsive. This
update fixes the ibmveth driver to set correct values of the gso_size
and gso_type variables and to calculate the value of the gso_segs
variable for large packets. As a result, the TCP session no longer
hangs in the described scenario. (BZ#1411381)

* Previously, booting a kdump kernel in some cases failed with this
error :

Kernel panic - not syncing: Watchdog detected hard LOCKUP on CPU 0.

This update ensures that the hpet timer software counters, including
hpet_default_delta and hpet_t1_cmp, are initialized before an
interrupt request is registered, and the kdump kernel now boots
without the mentioned error message. (BZ#1404183)

* When one of the drives became unresponsive, all other drives
intermittently hung, because the megaraid_sas driver incorrectly sent
a reset request to the PowerEdge RAID Controller (PERC). This update
fixes megaraid_sas, and thus the hang of one drive no longer leads to
intermittent loss of access to all drives on the system. (BZ#1398174)

See also :

https://www.redhat.com/security/data/cve/CVE-2017-6074.html
http://rhn.redhat.com/errata/RHSA-2017-0501.html

Solution :

Update the affected packages.

Risk factor :

High / CVSS Base Score : 7.2
(CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 6.0
(CVSS2#E:F/RL:OF/RC:ND)
Public Exploit Available : true

Family: Red Hat Local Security Checks

Nessus Plugin ID: 97750 ()

Bugtraq ID:

CVE ID: CVE-2017-6074

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now