Detections
Analytics
RHEL 7 : kernel (RHSA-2020:2522)
high Nessus Plugin ID 137363
Language:
Synopsis
The remote Red Hat host is missing one or more security updates for kernel.Description
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2522 advisory.The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: double free may be caused by the function allocate_trace_buffer in the file kernel/trace/trace.c (CVE-2017-18595)
* kernel: use-after-free in __blk_add_trace in kernel/trace/blktrace.c (CVE-2019-19768)
* Kernel: NetLabel: null pointer dereference while receiving CIPSO packet with null category may cause kernel panic (CVE-2020-10711)
* kernel: denial of service via ioctl call in network tun handling (CVE-2018-7191)
* kernel: usb: missing size check in the __usb_get_extra_descriptor() leading to DoS (CVE-2018-20169)
* kernel: perf_event_open() and execve() race in setuid programs allows a data leak (CVE-2019-3901)
* kernel: brcmfmac frame validation bypass (CVE-2019-9503)
* kernel: unchecked kstrdup of fwstr in drm_load_edid_firmware leads to denial of service (CVE-2019-12382)
* kernel: use-after-free in arch/x86/lib/insn-eval.c (CVE-2019-13233)
* kernel: integer overflow and OOB read in drivers/block/floppy.c (CVE-2019-14283)
* kernel: memory leak in register_queue_kobjects() in net/core/net-sysfs.c leads to denial of service (CVE-2019-15916)
* Kernel: net: using kernel space address bits to derive IP ID may potentially break KASLR (CVE-2019-10639)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
* Backport: Guest microcode version mismatch on secondary processors (BZ#1814002)
* Realtek 8111, 8112 stop working after upgrading to 3.10.0-1062 (BZ#1814601)
* [mlx5] Crash on reboot while having VF configured and in switchdev mode (BZ#1814800)
* qla2xxx: Urgent driver fix needed. Initiator does not relogin to target after receiving an explicit logout (BZ#1815595)
* High iSCSI read latency resolved by 'tcp: implement coalescing on backlog queue' (BZ#1817498)
* [RHEL7.8][Azure]Commits to resolve high network latency (BZ#1817934)
* NETDEV WATCHDOG: enp3s0 (r8169): transmit queue 0 timed out (BZ#1822541)
* RHEL7: block mq hang of a blk_mq_freeze_queue_wait(), which waits for a zero of a q_usage_counter, which never happens (BZ#1824545)
* Kernel crashes with a message fs/fscache/operation.c:449! (BZ#1826293)
* kernel BUG at fs/fscache/operation.c:70! FS-Cache: 4 == 5 is false - current state is FSCACHE_OP_ST_COMPLETE but should be FSCACHE_OP_CANCELLED in fscache_enqueue_operation (BZ#1839756)
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update the RHEL kernel package based on the guidance in RHSA-2020:2522.See Also
http://www.nessus.org/u?3bc9c293
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/errata/RHSA-2020:2522
https://bugzilla.redhat.com/show_bug.cgi?id=1660385
https://bugzilla.redhat.com/show_bug.cgi?id=1701245
https://bugzilla.redhat.com/show_bug.cgi?id=1701842
https://bugzilla.redhat.com/show_bug.cgi?id=1715554
https://bugzilla.redhat.com/show_bug.cgi?id=1716328
https://bugzilla.redhat.com/show_bug.cgi?id=1727756
https://bugzilla.redhat.com/show_bug.cgi?id=1729933
https://bugzilla.redhat.com/show_bug.cgi?id=1734243
https://bugzilla.redhat.com/show_bug.cgi?id=1750813
https://bugzilla.redhat.com/show_bug.cgi?id=1758671
Plugin Details
Severity: High
ID: 137363
File Name: redhat-RHSA-2020-2522.nasl
Version: 1.12
Type: local
Agent: unix
Family: Red Hat Local Security Checks
Published: 6/11/2020
Updated: 11/7/2024
Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: High
Score: 7.3
Vendor
Vendor Severity: Important
CVSS v2
Risk Factor: High
Base Score: 7.9
Temporal Score: 6.2
Vector: CVSS2#AV:A/AC:M/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2019-9503
CVSS v3
Risk Factor: High
Base Score: 8.3
Temporal Score: 7.5
Vector: CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
CPE: p-cpe:/a:redhat:enterprise_linux:bpftool, p-cpe:/a:redhat:enterprise_linux:kernel-tools, p-cpe:/a:redhat:enterprise_linux:kernel-headers, p-cpe:/a:redhat:enterprise_linux:kernel-devel, cpe:/o:redhat:rhel_eus:7.7, p-cpe:/a:redhat:enterprise_linux:kernel-tools-libs-devel, p-cpe:/a:redhat:enterprise_linux:kernel-debug-devel, p-cpe:/a:redhat:enterprise_linux:kernel-kdump, p-cpe:/a:redhat:enterprise_linux:kernel-bootwrapper, p-cpe:/a:redhat:enterprise_linux:kernel-tools-libs, p-cpe:/a:redhat:enterprise_linux:python-perf, p-cpe:/a:redhat:enterprise_linux:kernel-kdump-devel, p-cpe:/a:redhat:enterprise_linux:kernel, p-cpe:/a:redhat:enterprise_linux:kernel-debug, p-cpe:/a:redhat:enterprise_linux:perf
Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 6/11/2020
Vulnerability Publication Date: 4/25/2016
Reference Information
CVE: CVE-2017-18595, CVE-2018-20169, CVE-2018-7191, CVE-2019-10639, CVE-2019-12382, CVE-2019-13233, CVE-2019-14283, CVE-2019-15916, CVE-2019-19768, CVE-2019-3901, CVE-2019-9503, CVE-2020-10711