Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4576)
High Nessus Plugin ID 122804
Synopsis
The remote Oracle Linux host is missing one or more security updates.
Description
Description of changes:
kernel-uek [3.8.13-118.31.1.el6uek]
- alarmtimer: Prevent overflow for relative nanosleep (Thomas Gleixner) [Orabug: 29269167] {CVE-2018-13053}
- KEYS: Don't permit request_key() to construct a new keyring (David Howells) [Orabug: 29304552] {CVE-2017-17807}
- KEYS: add missing permission check for request_key() destination (Eric Biggers) [Orabug: 29304552] {CVE-2017-17807}
- ext4: only look at the bg_flags field if it is valid (Theodore Ts'o) [Orabug: 29409425] {CVE-2018-10876} {CVE-2018-10876}
- net: Set sk_prot_creator when cloning sockets to the right proto (Christoph Paasch) [Orabug: 29422740] {CVE-2018-9568}
- ext4: make sure bitmaps and the inode table don't overlap with bg descriptors (Theodore Ts'o) [Orabug: 29428608] {CVE-2018-10878}
- ext4: always check block group bounds in ext4_init_block_bitmap() (Theodore Ts'o) [Orabug: 29428608] {CVE-2018-10878}
Solution
Update the affected unbreakable enterprise kernel packages.