Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2019-4612)

high Nessus Plugin ID 124048

Language:

New! Vulnerability Priority Rating (VPR)

Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it is different from CVSS.

VPR Score: 6.7

Synopsis

The remote Oracle Linux host is missing one or more security updates.

Description

Description of changes:

[4.14.35-1844.4.5.el7uek]
- x86/apic/x2apic: set back affinity of a single interrupt to one cpu (Mridula Shastry) [Orabug: 29510342]

[4.14.35-1844.4.4.el7uek]
- ext4: fix data corruption caused by unaligned direct AIO (Lukas Czerner) [Orabug: 29598590]
- swiotlb: checking whether swiotlb buffer is full with io_tlb_used (Dongli Zhang) [Orabug: 29587097]
- swiotlb: add debugfs to track swiotlb buffer usage (Dongli Zhang) [Orabug: 29587097]
- swiotlb: fix comment on swiotlb_bounce() (Dongli Zhang) [Orabug: 29587097]
- scsi: target: add device product id and revision configfs attributes (Alan Adamson) [Orabug: 29344881]
- scsi: target: remove hardcoded T10 Vendor ID in INQUIRY response (David Disseldorp) [Orabug: 29344881]
- scsi: target: add device vendor_id configfs attribute (David Disseldorp) [Orabug: 29344881]
- scsi: target: consistently null-terminate t10_wwn strings (David Disseldorp) [Orabug: 29344881]
- scsi: target: use consistent left-aligned ASCII INQUIRY data (David Disseldorp) [Orabug: 29344881]
- x86/speculation: Keep enhanced IBRS on when prctl is used for SSBD control (Alejandro Jimenez) [Orabug: 29526400]
- drm/amdkfd: fix amdkfd use-after-free GP fault (Randy Dunlap) [Orabug: 29534199]

[4.14.35-1844.4.3.el7uek]
- can: gw: ensure DLC boundaries after CAN frame modification (Oliver Hartkopp) [Orabug: 29215297] {CVE-2019-3701} {CVE-2019-3701}

[4.14.35-1844.4.2.el7uek]
- x86/speculation: Clean up enhanced IBRS checks in bugs.c (Alejandro Jimenez) [Orabug: 29423796]
- x86/speculation: Keep enhanced IBRS on when spec_store_bypass_disable=on is used (Alejandro Jimenez) [Orabug: 29423796]
- kvm/speculation: Allow KVM guests to use SSBD even if host does not (Alejandro Jimenez) [Orabug: 29423796]
- exec: Fix mem leak in kernel_read_file (YueHaibing) [Orabug: 29454858] {CVE-2019-8980}
- net: crypto set sk to NULL when af_alg_release. (Mao Wenan) [Orabug: 29454874] {CVE-2019-8912}
- {net, IB}/mlx5: Raise fatal IB event when sys error occurs (Daniel Jurgens) [Orabug: 29479744]
- net/mlx5e: Avoid query PPCNT register if not supported by the device (Eyal Davidovich) [Orabug: 29479795]
- mm: enforce min addr even if capable() in expand_downwards() (Jann Horn) [Orabug: 29501977] {CVE-2019-9213}
- [UEK-5] IB/mlx5_core: Use kzalloc when allocating PD (Erez Alfasi) [Orabug: 29479806]
- IB/mlx5: Change debugfs to have per port contents (Parav Pandit) [Orabug: 29486784]
- Revert 'IB/mlx5: Change debugfs to have per port contents' (Qing Huang) [Orabug: 29486784]
- scsi: scsi_transport_iscsi: modify detected conn err to KERN_ERR (Fred Herard) [Orabug: 29487789]
- xen/blkfront: avoid NULL blkfront_info dereference on device removal (Vasilis Liaskovitis) [Orabug: 29489795]
- qlcnic: fix Tx descriptor corruption on 82xx devices (Shahed Shaikh) [Orabug: 29495427]

[4.14.35-1844.4.1.el7uek]
- scsi: libiscsi: Fix race between iscsi_xmit_task and iscsi_complete_task (Anoob Soman) [Orabug: 29024514]
- scsi: scsi_transport_iscsi: redirect conn error to console (Fred Herard) [Orabug: 29469713]
- Revert x86/apic/x2apic: set affinity of a single interrupt to one cpu (Mridula Shastry) [Orabug: 29469651]
- net/mlx5: Fix error handling in load one (Maor Gottlieb) [Orabug: 29019396]
- net/mlx5: Fix mlx5_get_uars_page to return error code (Eran Ben Elisha) [Orabug: 29019396]
- net/mlx5: Fix memory leak in bad flow of mlx5_alloc_irq_vectors (Alaa Hleihel) [Orabug: 29019396]
- net/mlx4_core: Fix wrong calculation of free counters (Eran Ben Elisha) [Orabug: 29019396]
- net/mlx5: Free IRQs in shutdown path (Daniel Jurgens) [Orabug: 29019427]
- net/mlx5e: DCBNL fix min inline header size for dscp (Huy Nguyen) [Orabug: 29019427]
- IB/mlx4: Fix integer overflow when calculating optimal MTT size (Jack Morgenstein) [Orabug: 29019427]
- net/mlx5: Fix mlx5_get_vector_affinity function (Israel Rukshin) [Orabug: 29019427]
- net/mlx5e: Fixed sleeping inside atomic context (Aviad Yehezkel) [Orabug: 29019427]
- IB/core: Generate GID change event regardless of RoCE GID table property (Parav Pandit) [Orabug: 29019427]
- net/mlx5: Vport, Use 'kvfree()' for memory allocated by 'kvzalloc()' (Christophe JAILLET) [Orabug: 29019430]
- IB/mlx4: Use 4K pages for kernel QP's WQE buffer (Jack Morgenstein) [Orabug: 29019795]
- net/mlx5: Add missing SET_DRIVER_VERSION command translation (Noa Osherovich) [Orabug: 29447325]
- net/mlx5: E-Switch, Fix memory leak when creating switchdev mode FDB tables (Raed Salem) [Orabug: 29447325]
- net/mlx5: Fix debugfs cleanup in the device init/remove flow (Jack Morgenstein) [Orabug: 29447325]
- net/mlx5: Check for error in mlx5_attach_interface (Huy Nguyen) [Orabug: 29447325]
- net/mlx5: Fix use-after-free in self-healing flow (Jack Morgenstein) [Orabug: 29447325]
- uek-rpm: update list of removed files, generated by depmod on install stage (Alexander Burmashev) [Orabug: 29460369]

[4.14.35-1844.4.0.el7uek]
- fs/dcache.c: add cond_resched() in shrink_dentry_list() (Nikolay Borisov) [Orabug: 29450975]
- net_failover: delay taking over primary device to accommodate udevd renaming (Si-Wei Liu)
- hugetlbfs: fix races and page leaks during migration (Mike Kravetz) [Orabug: 29443877]
- rds: update correct congestion map for loopback transport (Mukesh Kacker) [Orabug: 29431289]
- KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221) (Peter Shier) [Orabug: 29408638] {CVE-2019-7221}
- KVM: x86: work around leak of uninitialized stack contents (CVE-2019-7222) (Paolo Bonzini) [Orabug: 29408618] {CVE-2019-7222}
- kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974) (Jann Horn) [Orabug: 29408541] {CVE-2019-6974}
- ib_core: initialize shpd field when allocating 'struct ib_pd' (Mukesh Kacker) [Orabug: 29384900]
- bnxt_en: Return linux standard errors in bnxt_ethtool.c (Vasundhara Volam) [Orabug: 29261957]
- bnxt_en: Don't set ETS on unused TCs. (Michael Chan) [Orabug: 29261957]
- bnxt_en: get the reduced max_irqs by the ones used by RDMA (Vasundhara Volam) [Orabug: 29261957]
- bnxt_en: free hwrm resources, if driver probe fails. (Venkat Duvvuru) [Orabug: 29261957]
- bnxt_en: Fix enables field in HWRM_QUEUE_COS2BW_CFG request (Vasundhara Volam) [Orabug: 29261957]
- bnxt_en: Fix VNIC reservations on the PF. (Michael Chan) [Orabug: 29261957]

Solution

Update the affected unbreakable enterprise kernel packages.

See Also

https://oss.oracle.com/pipermail/el-errata/2019-April/008648.html

Plugin Details

Severity: High

ID: 124048

File Name: oraclelinux_ELSA-2019-4612.nasl

Version: 1.7

Type: local

Agent: unix

Published: 4/15/2019

Updated: 1/24/2020

Dependencies: 122878, 12634

Risk Information

Risk Factor: High

VPR Score: 6.7

CVSS Score Source: CVE-2019-8912

CVSS v2.0

Base Score: 7.2

Temporal Score: 6

Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: E:F/RL:OF/RC:C

CVSS v3.0

Base Score: 7.8

Temporal Score: 7.2

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: E:F/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:oracle:linux:kernel-uek, p-cpe:/a:oracle:linux:kernel-uek-debug, p-cpe:/a:oracle:linux:kernel-uek-debug-devel, p-cpe:/a:oracle:linux:kernel-uek-devel, p-cpe:/a:oracle:linux:kernel-uek-doc, p-cpe:/a:oracle:linux:kernel-uek-tools, cpe:/o:oracle:linux:7

Required KB Items: Host/local_checks_enabled, Host/OracleLinux, Host/RedHat/release, Host/RedHat/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 4/12/2019

Vulnerability Publication Date: 1/3/2019

Exploitable With

Metasploit (Reliable Datagram Sockets (RDS) rds_atomic_free_op NULL pointer dereference Privilege Escalation)

Reference Information

CVE: CVE-2019-3701, CVE-2019-6974, CVE-2019-7221, CVE-2019-7222, CVE-2019-8912, CVE-2019-8980, CVE-2019-9213