RHEL 7 : kernel-alt (RHSA-2018:2948) (Spectre)

High Nessus Plugin ID 118513

Synopsis

The remote Red Hat host is missing one or more security updates.

Description

An update for kernel-alt is now available for Red Hat Enterprise Linux
7.

Red Hat Product Security has rated this update as having a security
impact of Important. A Common Vulnerability Scoring System (CVSS) base
score, which gives a detailed severity rating, is available for each
vulnerability from the CVE link(s) in the References section.

The kernel-alt packages provide the Linux kernel version 4.x.

Security Fix(es) :

* An industry-wide issue was found in the way many modern
microprocessor designs have implemented speculative execution of Load
& Store instructions (a commonly used performance optimization). It
relies on the presence of a precisely-defined instruction sequence in
the privileged code as well as the fact that memory read from address
to which a recent memory write has occurred may see an older value and
subsequently cause an update into the microprocessor's data cache even
for speculatively executed instructions that never actually commit
(retire). As a result, an unprivileged attacker could use this flaw to
read privileged memory by conducting targeted cache side-channel
attacks. (CVE-2018-3639, aarch64)

* A flaw named SegmentSmack was found in the way the Linux kernel
handled specially crafted TCP packets. A remote attacker could use
this flaw to trigger time and calculation expensive calls to
tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() functions by
sending specially modified packets within ongoing TCP sessions which
could lead to a CPU saturation and hence a denial of service on the
system. Maintaining the denial of service condition requires
continuous two-way TCP sessions to a reachable open port, thus the
attacks cannot be performed using spoofed IP addresses.
(CVE-2018-5390)

* A flaw named FragmentSmack was found in the way the Linux kernel
handled reassembly of fragmented IPv4 and IPv6 packets. A remote
attacker could use this flaw to trigger time and calculation expensive
fragment reassembly algorithm by sending specially crafted packets
which could lead to a CPU saturation and hence a denial of service on
the system. (CVE-2018-5391)

Space precludes documenting all of the security fixes in this
advisory. See the descriptions of the remaining security fixes in the
related Knowledge Article :

https://access.redhat.com/articles/3658021

For more details about the security issue(s), including the impact, a
CVSS score, and other related information, refer to the CVE page(s)
listed in the References section.

Red Hat would like to thank Ken Johnson (Microsoft Security Response
Center) and Jann Horn (Google Project Zero) for reporting
CVE-2018-3639; Juha-Matti Tilli (Aalto University - Department of
Communications and Networking and Nokia Bell Labs) for reporting
CVE-2018-5390 and CVE-2018-5391; Qualys Research Labs for reporting
CVE-2018-1120; David Rientjes (Google) for reporting CVE-2018-1000200;
and Wen Xu for reporting CVE-2018-1092, CVE-2018-1094, and
CVE-2018-1095. The CVE-2018-14619 issue was discovered by Florian
Weimer (Red Hat) and Ondrej Mosnacek (Red Hat).

Additional Changes :

For detailed information on changes in this release, see the Red Hat
Enterprise Linux 7.6 Release Notes linked from the References section.

Solution

Update the affected packages.

See Also

https://access.redhat.com/articles/3553061

https://access.redhat.com/security/vulnerabilities/ssbd

http://www.nessus.org/u?3395ff0b

https://access.redhat.com/articles/3658021

https://access.redhat.com/errata/RHSA-2018:2948

https://access.redhat.com/security/cve/cve-2017-13166

https://access.redhat.com/security/cve/cve-2017-16648

https://access.redhat.com/security/cve/cve-2017-17805

https://access.redhat.com/security/cve/cve-2017-17806

https://access.redhat.com/security/cve/cve-2017-18075

https://access.redhat.com/security/cve/cve-2017-18208

https://access.redhat.com/security/cve/cve-2017-18344

https://access.redhat.com/security/cve/cve-2018-1065

https://access.redhat.com/security/cve/cve-2018-1068

https://access.redhat.com/security/cve/cve-2018-1092

https://access.redhat.com/security/cve/cve-2018-1094

https://access.redhat.com/security/cve/cve-2018-1095

https://access.redhat.com/security/cve/cve-2018-1118

https://access.redhat.com/security/cve/cve-2018-1120

https://access.redhat.com/security/cve/cve-2018-3639

https://access.redhat.com/security/cve/cve-2018-5344

https://access.redhat.com/security/cve/cve-2018-5390

https://access.redhat.com/security/cve/cve-2018-5391

https://access.redhat.com/security/cve/cve-2018-5750

https://access.redhat.com/security/cve/cve-2018-5803

https://access.redhat.com/security/cve/cve-2018-5848

https://access.redhat.com/security/cve/cve-2018-7566

https://access.redhat.com/security/cve/cve-2018-7757

https://access.redhat.com/security/cve/cve-2018-8781

https://access.redhat.com/security/cve/cve-2018-9363

https://access.redhat.com/security/cve/cve-2018-10322

https://access.redhat.com/security/cve/cve-2018-10877

https://access.redhat.com/security/cve/cve-2018-10878

https://access.redhat.com/security/cve/cve-2018-10879

https://access.redhat.com/security/cve/cve-2018-10880

https://access.redhat.com/security/cve/cve-2018-10881

https://access.redhat.com/security/cve/cve-2018-10882

https://access.redhat.com/security/cve/cve-2018-10883

https://access.redhat.com/security/cve/cve-2018-10940

https://access.redhat.com/security/cve/cve-2018-11506

https://access.redhat.com/security/cve/cve-2018-12232

https://access.redhat.com/security/cve/cve-2018-13405

https://access.redhat.com/security/cve/cve-2018-14619

https://access.redhat.com/security/cve/cve-2018-14641

https://access.redhat.com/security/cve/cve-2018-1000026

https://access.redhat.com/security/cve/cve-2018-1000200

https://access.redhat.com/security/cve/cve-2018-1000204

Plugin Details

Severity: High

ID: 118513

File Name: redhat-RHSA-2018-2948.nasl

Version: 1.4

Type: local

Agent: unix

Published: 2018/10/31

Modified: 2018/12/13

Dependencies: 12634

Risk Information

Risk Factor: High

CVSS v2.0

Base Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS v3.0

Base Score: 8.4

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:kernel, p-cpe:/a:redhat:enterprise_linux:kernel-abi-whitelists, p-cpe:/a:redhat:enterprise_linux:kernel-debug, p-cpe:/a:redhat:enterprise_linux:kernel-debug-debuginfo, p-cpe:/a:redhat:enterprise_linux:kernel-debug-devel, p-cpe:/a:redhat:enterprise_linux:kernel-debuginfo, p-cpe:/a:redhat:enterprise_linux:kernel-debuginfo-common-s390x, p-cpe:/a:redhat:enterprise_linux:kernel-devel, p-cpe:/a:redhat:enterprise_linux:kernel-doc, p-cpe:/a:redhat:enterprise_linux:kernel-headers, p-cpe:/a:redhat:enterprise_linux:kernel-kdump, p-cpe:/a:redhat:enterprise_linux:kernel-kdump-debuginfo, p-cpe:/a:redhat:enterprise_linux:kernel-kdump-devel, p-cpe:/a:redhat:enterprise_linux:perf, p-cpe:/a:redhat:enterprise_linux:perf-debuginfo, p-cpe:/a:redhat:enterprise_linux:python-perf, p-cpe:/a:redhat:enterprise_linux:python-perf-debuginfo, cpe:/o:redhat:enterprise_linux:7

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2018/10/30

Exploitable With

CANVAS (CANVAS)

Reference Information

CVE: CVE-2017-13166, CVE-2017-16648, CVE-2017-17805, CVE-2017-17806, CVE-2017-18075, CVE-2017-18208, CVE-2017-18344, CVE-2018-1000026, CVE-2018-1000200, CVE-2018-1000204, CVE-2018-10322, CVE-2018-1065, CVE-2018-1068, CVE-2018-10877, CVE-2018-10878, CVE-2018-10879, CVE-2018-10880, CVE-2018-10881, CVE-2018-10882, CVE-2018-10883, CVE-2018-1092, CVE-2018-1094, CVE-2018-10940, CVE-2018-1095, CVE-2018-1118, CVE-2018-1120, CVE-2018-11506, CVE-2018-12232, CVE-2018-13405, CVE-2018-14619, CVE-2018-14641, CVE-2018-3639, CVE-2018-5344, CVE-2018-5390, CVE-2018-5391, CVE-2018-5750, CVE-2018-5803, CVE-2018-5848, CVE-2018-7566, CVE-2018-7757, CVE-2018-8781, CVE-2018-9363

RHSA: 2018:2948