RHEL 7 : kernel-alt (RHSA-2018:2948) (Spectre)

High Nessus Plugin ID 118513

Synopsis

The remote Red Hat host is missing one or more security updates.

Description

An update for kernel-alt is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel-alt packages provide the Linux kernel version 4.x.

Security Fix(es) :

* An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions (a commonly used performance optimization). It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory read from address to which a recent memory write has occurred may see an older value and subsequently cause an update into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to read privileged memory by conducting targeted cache side-channel attacks. (CVE-2018-3639, aarch64)

* A flaw named SegmentSmack was found in the way the Linux kernel handled specially crafted TCP packets. A remote attacker could use this flaw to trigger time and calculation expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() functions by sending specially modified packets within ongoing TCP sessions which could lead to a CPU saturation and hence a denial of service on the system. Maintaining the denial of service condition requires continuous two-way TCP sessions to a reachable open port, thus the attacks cannot be performed using spoofed IP addresses.
(CVE-2018-5390)

* A flaw named FragmentSmack was found in the way the Linux kernel handled reassembly of fragmented IPv4 and IPv6 packets. A remote attacker could use this flaw to trigger time and calculation expensive fragment reassembly algorithm by sending specially crafted packets which could lead to a CPU saturation and hence a denial of service on the system. (CVE-2018-5391)

Space precludes documenting all of the security fixes in this advisory. See the descriptions of the remaining security fixes in the related Knowledge Article :

https://access.redhat.com/articles/3658021

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank Ken Johnson (Microsoft Security Response Center) and Jann Horn (Google Project Zero) for reporting CVE-2018-3639; Juha-Matti Tilli (Aalto University - Department of Communications and Networking and Nokia Bell Labs) for reporting CVE-2018-5390 and CVE-2018-5391; Qualys Research Labs for reporting CVE-2018-1120; David Rientjes (Google) for reporting CVE-2018-1000200;
and Wen Xu for reporting CVE-2018-1092, CVE-2018-1094, and CVE-2018-1095. The CVE-2018-14619 issue was discovered by Florian Weimer (Red Hat) and Ondrej Mosnacek (Red Hat).

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes linked from the References section.

Solution

Update the affected packages.

See Also

https://access.redhat.com/articles/3553061

https://access.redhat.com/security/vulnerabilities/ssbd

http://www.nessus.org/u?3395ff0b

https://access.redhat.com/articles/3658021

https://access.redhat.com/errata/RHSA-2018:2948

https://access.redhat.com/security/cve/cve-2017-13166

https://access.redhat.com/security/cve/cve-2017-16648

https://access.redhat.com/security/cve/cve-2017-17805

https://access.redhat.com/security/cve/cve-2017-17806

https://access.redhat.com/security/cve/cve-2017-18075

https://access.redhat.com/security/cve/cve-2017-18208

https://access.redhat.com/security/cve/cve-2017-18344

https://access.redhat.com/security/cve/cve-2018-1065

https://access.redhat.com/security/cve/cve-2018-1068

https://access.redhat.com/security/cve/cve-2018-1092

https://access.redhat.com/security/cve/cve-2018-1094

https://access.redhat.com/security/cve/cve-2018-1095

https://access.redhat.com/security/cve/cve-2018-1118

https://access.redhat.com/security/cve/cve-2018-1120

https://access.redhat.com/security/cve/cve-2018-3639

https://access.redhat.com/security/cve/cve-2018-5344

https://access.redhat.com/security/cve/cve-2018-5390

https://access.redhat.com/security/cve/cve-2018-5391

https://access.redhat.com/security/cve/cve-2018-5750

https://access.redhat.com/security/cve/cve-2018-5803

https://access.redhat.com/security/cve/cve-2018-5848

https://access.redhat.com/security/cve/cve-2018-7566

https://access.redhat.com/security/cve/cve-2018-7757

https://access.redhat.com/security/cve/cve-2018-8781

https://access.redhat.com/security/cve/cve-2018-9363

https://access.redhat.com/security/cve/cve-2018-10322

https://access.redhat.com/security/cve/cve-2018-10877

https://access.redhat.com/security/cve/cve-2018-10878

https://access.redhat.com/security/cve/cve-2018-10879

https://access.redhat.com/security/cve/cve-2018-10880

https://access.redhat.com/security/cve/cve-2018-10881

https://access.redhat.com/security/cve/cve-2018-10882

https://access.redhat.com/security/cve/cve-2018-10883

https://access.redhat.com/security/cve/cve-2018-10940

https://access.redhat.com/security/cve/cve-2018-11506

https://access.redhat.com/security/cve/cve-2018-12232

https://access.redhat.com/security/cve/cve-2018-13405

https://access.redhat.com/security/cve/cve-2018-14619

https://access.redhat.com/security/cve/cve-2018-14641

https://access.redhat.com/security/cve/cve-2018-1000026

https://access.redhat.com/security/cve/cve-2018-1000200

https://access.redhat.com/security/cve/cve-2018-1000204

Plugin Details

Severity: High

ID: 118513

File Name: redhat-RHSA-2018-2948.nasl

Version: 1.3

Type: local

Agent: unix

Published: 2018/10/31

Modified: 2018/11/10

Dependencies: 12634

Risk Information

Risk Factor: High

CVSS v2.0

Base Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS v3.0

Base Score: 7.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:kernel, p-cpe:/a:redhat:enterprise_linux:kernel-abi-whitelists, p-cpe:/a:redhat:enterprise_linux:kernel-debug, p-cpe:/a:redhat:enterprise_linux:kernel-debug-debuginfo, p-cpe:/a:redhat:enterprise_linux:kernel-debug-devel, p-cpe:/a:redhat:enterprise_linux:kernel-debuginfo, p-cpe:/a:redhat:enterprise_linux:kernel-debuginfo-common-s390x, p-cpe:/a:redhat:enterprise_linux:kernel-devel, p-cpe:/a:redhat:enterprise_linux:kernel-doc, p-cpe:/a:redhat:enterprise_linux:kernel-headers, p-cpe:/a:redhat:enterprise_linux:kernel-kdump, p-cpe:/a:redhat:enterprise_linux:kernel-kdump-debuginfo, p-cpe:/a:redhat:enterprise_linux:kernel-kdump-devel, p-cpe:/a:redhat:enterprise_linux:perf, p-cpe:/a:redhat:enterprise_linux:perf-debuginfo, p-cpe:/a:redhat:enterprise_linux:python-perf, p-cpe:/a:redhat:enterprise_linux:python-perf-debuginfo, cpe:/o:redhat:enterprise_linux:7

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2018/10/30

Exploitable With

CANVAS (CANVAS)

Reference Information

CVE: CVE-2017-13166, CVE-2017-16648, CVE-2017-17805, CVE-2017-17806, CVE-2017-18075, CVE-2017-18208, CVE-2017-18344, CVE-2018-1000026, CVE-2018-1000200, CVE-2018-1000204, CVE-2018-10322, CVE-2018-1065, CVE-2018-1068, CVE-2018-10877, CVE-2018-10878, CVE-2018-10879, CVE-2018-10880, CVE-2018-10881, CVE-2018-10882, CVE-2018-10883, CVE-2018-1092, CVE-2018-1094, CVE-2018-10940, CVE-2018-1095, CVE-2018-1118, CVE-2018-1120, CVE-2018-11506, CVE-2018-12232, CVE-2018-13405, CVE-2018-14619, CVE-2018-14641, CVE-2018-3639, CVE-2018-5344, CVE-2018-5390, CVE-2018-5391, CVE-2018-5750, CVE-2018-5803, CVE-2018-5848, CVE-2018-7566, CVE-2018-7757, CVE-2018-8781, CVE-2018-9363

RHSA: 2018:2948