4.9 - RHSA-2018:3843

Problem Description:

An update for kernel is now available for Red Hat Enterprise Linux 7.5 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux ComputeNode EUS (v. 7.5) - noarch, x86_64 Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.5) - x86_64 Red Hat Enterprise Linux Server EUS (v. 7.5) - noarch, ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional EUS (v. 7.5) - ppc64, ppc64le, x86_64

3. Description:

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: NULL pointer dereference in af_netlink.c:__netlink_ns_capable() allows for denial of service (CVE-2018-14646)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank Christian Brauner for reporting this issue.

Bug Fix(es):

* Previously, the kernel architectures for IBM z Systems were missing support to display the status of the Spectre v2 mitigations. As a consequence, the /sys/devices/system/cpu/vulnerabilities/spectre_v2 file did not exist. With this update, the kernel now shows the status in the above mentioned file and as a result, the file now reports either "Vulnerable" or "Mitigation: execute trampolines" message. (BZ#1636884)

* Previously, under certain conditions, the page direct reclaim code was occasionally stuck in a loop when waiting for the reclaim to finish. As a consequence, affected applications became unresponsive with no progress possible. This update fixes the bug by modifying the page direct reclaim code to bound the waiting time for the reclaim to finish. As a consequence, the affected applications no longer hang in the described scenario. (BZ#1635132)

* Previously, a packet was missing the User Datagram Protocol (UDP) payload checksum during a full checksum computation, if the hardware checksum was not applied. As a consequence, a packet with an incorrect checksum was dropped by a peer. With this update, the kernel includes the UDP payload checksum during the full checksum computation. As a result, the checksum is computed correctly and the packet can be received by the peer. (BZ#1635796)

* Previously, on user setups running a mixed workload, the scheduler did not pick up tasks because the runqueues were throttled for a long time. As a consequence, the system became partially unresponsive. To fix this bug, the kernel now sets a flag in the cfs_bandwidth struct to secure better task distribution. As a result, the system no longer becomes unresponsive in the described scenario. (BZ#1640676)

* Previously, clearing a CPU mask with the cgroups feature triggered the following warning:

kernel: WARNING: CPU: 422 PID: 364940 at kernel/cpuset.c:955 update_cpumasks_hier+0x3af/0x410

As a consequence, the user's log file was flooded with similar warning messages as above. This update fixes the bug and the warning message no longer appears in the described scenario. (BZ#1644237)

* Previously, a lot of CPU time was occasionally spent in the kernel during a teardown of a container with a lot of memory assigned. As a consequence, an increased risk of CPU soft lockups could occur due to higher latency of a CPU scheduler for other processes during the container teardown. To fix the problem, the kernel now adds a reschedule to the tight kernel loop. As a result, the CPU scheduler latency is not increased by the container teardown and there is not the increased risk of CPU soft lockups in the described scenario. (BZ#1644672)

* When a user created a VLAN device, the kernel set the wanted_features set of the VLAN to the current features of the base device. As a consequence, when the base device got new features, the features were not propagated to the VLAN device. This update fixes the bug and the VLAN device receives the new features in the described scenario.

Note that this only affects TCP Segmentation Offload (TSO). (BZ#1644674)

4. Solution:

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

1630124 - CVE-2018-14646 kernel: NULL pointer dereference in af_netlink.c:__netlink_ns_capable() allows for denial of service