ID

VAR-201805-0963

CVE

CVE-2018-3639

TITLE

CPU hardware utilizing speculative execution may be vulnerable to cache side-channel attacks

DESCRIPTION

Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4. CPU hardware utilizing speculative execution may be vulnerable to cache timing side-channel analysis. Two vulnerabilities are identified, known as "Variant 3a" and "Variant 4". CPUhardware is firmware that runs in the central processor for managing and controlling the CPU. Multiple CPUHardware information disclosure vulnerabilities. The vulnerability is caused by a race condition in the CPU cache processing. Local attackers can exploit vulnerabilities to obtain sensitive information through side channel analysis. AMD, ARM, and Intel CPUs are all CPU (central processing unit) products from different manufacturers. AMD, ARM, and Intel CPUs have security vulnerabilities. Relevant releases/architectures: RHV-M 4.2 - noarch 3. Description: The org.ovirt.engine-root is a core component of oVirt. 7) - x86_64 3. Description: Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM. Once all virtual machines have shut down, start them again for this update to take effect. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: kernel security and bug fix update Advisory ID: RHSA-2018:1854-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2018:1854 Issue date: 2018-06-19 CVE Names: CVE-2012-6701 CVE-2015-8830 CVE-2016-8650 CVE-2017-2671 CVE-2017-6001 CVE-2017-7308 CVE-2017-7616 CVE-2017-7889 CVE-2017-8890 CVE-2017-9075 CVE-2017-9076 CVE-2017-9077 CVE-2017-12190 CVE-2017-15121 CVE-2017-18203 CVE-2018-1130 CVE-2018-3639 CVE-2018-5803 ===================================================================== 1. Summary: An update for kernel is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 6) - i386, noarch, x86_64 Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux HPC Node (v. 6) - noarch, x86_64 Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, noarch, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, noarch, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64 3. Description: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions (a commonly used performance optimization). It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory read from address to which a recent memory write has occurred may see an older value and subsequently cause an update into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to read privileged memory by conducting targeted cache side-channel attacks. (CVE-2018-3639, PowerPC) * kernel: net/packet: overflow in check for priv area size (CVE-2017-7308) * kernel: AIO interface didn't use rw_verify_area() for checking mandatory locking on files and size of access (CVE-2012-6701) * kernel: AIO write triggers integer overflow in some protocols (CVE-2015-8830) * kernel: Null pointer dereference via keyctl (CVE-2016-8650) * kernel: ping socket / AF_LLC connect() sin_family race (CVE-2017-2671) * kernel: Race condition between multiple sys_perf_event_open() calls (CVE-2017-6001) * kernel: Incorrect error handling in the set_mempolicy and mbind compat syscalls in mm/mempolicy.c (CVE-2017-7616) * kernel: mm subsystem does not properly enforce the CONFIG_STRICT_DEVMEM protection mechanism (CVE-2017-7889) * kernel: Double free in the inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c (CVE-2017-8890) * kernel: net: sctp_v6_create_accept_sk function mishandles inheritance (CVE-2017-9075) * kernel: net: IPv6 DCCP implementation mishandles inheritance (CVE-2017-9076) * kernel: net: tcp_v6_syn_recv_sock function mishandles inheritance (CVE-2017-9077) * kernel: memory leak when merging buffers in SCSI IO vectors (CVE-2017-12190) * kernel: vfs: BUG in truncate_inode_pages_range() and fuse client (CVE-2017-15121) * kernel: Race condition in drivers/md/dm.c:dm_get_from_kobject() allows local users to cause a denial of service (CVE-2017-18203) * kernel: a null pointer dereference in net/dccp/output.c:dccp_write_xmit() leads to a system crash (CVE-2018-1130) * kernel: Missing length check of payload in net/sctp/sm_make_chunk.c:_sctp_make_chunk() function allows denial of service (CVE-2018-5803) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. The CVE-2017-15121 issue was discovered by Miklos Szeredi (Red Hat). Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 6.10 Release Notes and Red Hat Enterprise Linux 6.10 Technical Notes linked from the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 869942 - Kernel crashes on reading an ACL containing 190 ACEs over NFSv4 1314275 - CVE-2015-8830 kernel: AIO write triggers integer overflow in some protocols 1314288 - CVE-2012-6701 kernel: AIO interface didn't use rw_verify_area() for checking mandatory locking on files and size of access 1395187 - CVE-2016-8650 kernel: Null pointer dereference via keyctl 1422825 - CVE-2017-6001 kernel: Race condition between multiple sys_perf_event_open() calls 1436649 - CVE-2017-2671 kernel: ping socket / AF_LLC connect() sin_family race 1437404 - CVE-2017-7308 kernel: net/packet: overflow in check for priv area size 1441088 - CVE-2017-7616 kernel: Incorrect error handling in the set_mempolicy and mbind compat syscalls in mm/mempolicy.c 1444493 - CVE-2017-7889 kernel: mm subsystem does not properly enforce the CONFIG_STRICT_DEVMEM protection mechanism 1448170 - RHEL6.9: sunrpc reconnect logic now may trigger a SYN storm when a TCP connection drops and a burst of RPC commands hit the transport 1450972 - CVE-2017-8890 kernel: Double free in the inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c 1452688 - CVE-2017-9076 kernel: net: IPv6 DCCP implementation mishandles inheritance 1452691 - CVE-2017-9075 kernel: net: sctp_v6_create_accept_sk function mishandles inheritance 1452744 - CVE-2017-9077 kernel: net: tcp_v6_syn_recv_sock function mishandles inheritance 1495089 - CVE-2017-12190 kernel: memory leak when merging buffers in SCSI IO vectors 1497152 - systool causes panic on 2.6.32-696.6.3.el6.x86_64 using be2iscsi 1520893 - CVE-2017-15121 kernel: vfs: BUG in truncate_inode_pages_range() and fuse client 1550811 - CVE-2017-18203 kernel: Race condition in drivers/md/dm.c:dm_get_from_kobject() allows local users to cause a denial of service 1551051 - CVE-2018-5803 kernel: Missing length check of payload in net/sctp/sm_make_chunk.c:_sctp_make_chunk() function allows denial of service 1560494 - i686: Using invpcid_flush_all_nonglobals() can cause user-space panic on .i686 1566890 - CVE-2018-3639 hw: cpu: speculative store bypass 1576419 - CVE-2018-1130 kernel: a null pointer dereference in net/dccp/output.c:dccp_write_xmit() leads to a system crash 6. Package List: Red Hat Enterprise Linux Desktop (v. 6): Source: kernel-2.6.32-754.el6.src.rpm i386: kernel-2.6.32-754.el6.i686.rpm kernel-debug-2.6.32-754.el6.i686.rpm kernel-debug-debuginfo-2.6.32-754.el6.i686.rpm kernel-debug-devel-2.6.32-754.el6.i686.rpm kernel-debuginfo-2.6.32-754.el6.i686.rpm kernel-debuginfo-common-i686-2.6.32-754.el6.i686.rpm kernel-devel-2.6.32-754.el6.i686.rpm kernel-headers-2.6.32-754.el6.i686.rpm perf-2.6.32-754.el6.i686.rpm perf-debuginfo-2.6.32-754.el6.i686.rpm python-perf-debuginfo-2.6.32-754.el6.i686.rpm noarch: kernel-abi-whitelists-2.6.32-754.el6.noarch.rpm kernel-doc-2.6.32-754.el6.noarch.rpm kernel-firmware-2.6.32-754.el6.noarch.rpm x86_64: kernel-2.6.32-754.el6.x86_64.rpm kernel-debug-2.6.32-754.el6.x86_64.rpm kernel-debug-debuginfo-2.6.32-754.el6.i686.rpm kernel-debug-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debug-devel-2.6.32-754.el6.i686.rpm kernel-debug-devel-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-2.6.32-754.el6.i686.rpm kernel-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-common-i686-2.6.32-754.el6.i686.rpm kernel-debuginfo-common-x86_64-2.6.32-754.el6.x86_64.rpm kernel-devel-2.6.32-754.el6.x86_64.rpm kernel-headers-2.6.32-754.el6.x86_64.rpm perf-2.6.32-754.el6.x86_64.rpm perf-debuginfo-2.6.32-754.el6.i686.rpm perf-debuginfo-2.6.32-754.el6.x86_64.rpm python-perf-debuginfo-2.6.32-754.el6.i686.rpm python-perf-debuginfo-2.6.32-754.el6.x86_64.rpm Red Hat Enterprise Linux Desktop Optional (v. 6): i386: kernel-debug-debuginfo-2.6.32-754.el6.i686.rpm kernel-debuginfo-2.6.32-754.el6.i686.rpm kernel-debuginfo-common-i686-2.6.32-754.el6.i686.rpm perf-debuginfo-2.6.32-754.el6.i686.rpm python-perf-2.6.32-754.el6.i686.rpm python-perf-debuginfo-2.6.32-754.el6.i686.rpm x86_64: kernel-debug-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-common-x86_64-2.6.32-754.el6.x86_64.rpm perf-debuginfo-2.6.32-754.el6.x86_64.rpm python-perf-2.6.32-754.el6.x86_64.rpm python-perf-debuginfo-2.6.32-754.el6.x86_64.rpm Red Hat Enterprise Linux HPC Node (v. 6): Source: kernel-2.6.32-754.el6.src.rpm noarch: kernel-abi-whitelists-2.6.32-754.el6.noarch.rpm kernel-doc-2.6.32-754.el6.noarch.rpm kernel-firmware-2.6.32-754.el6.noarch.rpm x86_64: kernel-2.6.32-754.el6.x86_64.rpm kernel-debug-2.6.32-754.el6.x86_64.rpm kernel-debug-debuginfo-2.6.32-754.el6.i686.rpm kernel-debug-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debug-devel-2.6.32-754.el6.i686.rpm kernel-debug-devel-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-2.6.32-754.el6.i686.rpm kernel-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-common-i686-2.6.32-754.el6.i686.rpm kernel-debuginfo-common-x86_64-2.6.32-754.el6.x86_64.rpm kernel-devel-2.6.32-754.el6.x86_64.rpm kernel-headers-2.6.32-754.el6.x86_64.rpm perf-2.6.32-754.el6.x86_64.rpm perf-debuginfo-2.6.32-754.el6.i686.rpm perf-debuginfo-2.6.32-754.el6.x86_64.rpm python-perf-debuginfo-2.6.32-754.el6.i686.rpm python-perf-debuginfo-2.6.32-754.el6.x86_64.rpm Red Hat Enterprise Linux HPC Node Optional (v. 6): x86_64: kernel-debug-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-common-x86_64-2.6.32-754.el6.x86_64.rpm perf-debuginfo-2.6.32-754.el6.x86_64.rpm python-perf-2.6.32-754.el6.x86_64.rpm python-perf-debuginfo-2.6.32-754.el6.x86_64.rpm Red Hat Enterprise Linux Server (v. 6): Source: kernel-2.6.32-754.el6.src.rpm i386: kernel-2.6.32-754.el6.i686.rpm kernel-debug-2.6.32-754.el6.i686.rpm kernel-debug-debuginfo-2.6.32-754.el6.i686.rpm kernel-debug-devel-2.6.32-754.el6.i686.rpm kernel-debuginfo-2.6.32-754.el6.i686.rpm kernel-debuginfo-common-i686-2.6.32-754.el6.i686.rpm kernel-devel-2.6.32-754.el6.i686.rpm kernel-headers-2.6.32-754.el6.i686.rpm perf-2.6.32-754.el6.i686.rpm perf-debuginfo-2.6.32-754.el6.i686.rpm python-perf-debuginfo-2.6.32-754.el6.i686.rpm noarch: kernel-abi-whitelists-2.6.32-754.el6.noarch.rpm kernel-doc-2.6.32-754.el6.noarch.rpm kernel-firmware-2.6.32-754.el6.noarch.rpm ppc64: kernel-2.6.32-754.el6.ppc64.rpm kernel-bootwrapper-2.6.32-754.el6.ppc64.rpm kernel-debug-2.6.32-754.el6.ppc64.rpm kernel-debug-debuginfo-2.6.32-754.el6.ppc64.rpm kernel-debug-devel-2.6.32-754.el6.ppc64.rpm kernel-debuginfo-2.6.32-754.el6.ppc64.rpm kernel-debuginfo-common-ppc64-2.6.32-754.el6.ppc64.rpm kernel-devel-2.6.32-754.el6.ppc64.rpm kernel-headers-2.6.32-754.el6.ppc64.rpm perf-2.6.32-754.el6.ppc64.rpm perf-debuginfo-2.6.32-754.el6.ppc64.rpm python-perf-debuginfo-2.6.32-754.el6.ppc64.rpm s390x: kernel-2.6.32-754.el6.s390x.rpm kernel-debug-2.6.32-754.el6.s390x.rpm kernel-debug-debuginfo-2.6.32-754.el6.s390x.rpm kernel-debug-devel-2.6.32-754.el6.s390x.rpm kernel-debuginfo-2.6.32-754.el6.s390x.rpm kernel-debuginfo-common-s390x-2.6.32-754.el6.s390x.rpm kernel-devel-2.6.32-754.el6.s390x.rpm kernel-headers-2.6.32-754.el6.s390x.rpm kernel-kdump-2.6.32-754.el6.s390x.rpm kernel-kdump-debuginfo-2.6.32-754.el6.s390x.rpm kernel-kdump-devel-2.6.32-754.el6.s390x.rpm perf-2.6.32-754.el6.s390x.rpm perf-debuginfo-2.6.32-754.el6.s390x.rpm python-perf-debuginfo-2.6.32-754.el6.s390x.rpm x86_64: kernel-2.6.32-754.el6.x86_64.rpm kernel-debug-2.6.32-754.el6.x86_64.rpm kernel-debug-debuginfo-2.6.32-754.el6.i686.rpm kernel-debug-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debug-devel-2.6.32-754.el6.i686.rpm kernel-debug-devel-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-2.6.32-754.el6.i686.rpm kernel-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-common-i686-2.6.32-754.el6.i686.rpm kernel-debuginfo-common-x86_64-2.6.32-754.el6.x86_64.rpm kernel-devel-2.6.32-754.el6.x86_64.rpm kernel-headers-2.6.32-754.el6.x86_64.rpm perf-2.6.32-754.el6.x86_64.rpm perf-debuginfo-2.6.32-754.el6.i686.rpm perf-debuginfo-2.6.32-754.el6.x86_64.rpm python-perf-debuginfo-2.6.32-754.el6.i686.rpm python-perf-debuginfo-2.6.32-754.el6.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 6): i386: kernel-debug-debuginfo-2.6.32-754.el6.i686.rpm kernel-debuginfo-2.6.32-754.el6.i686.rpm kernel-debuginfo-common-i686-2.6.32-754.el6.i686.rpm perf-debuginfo-2.6.32-754.el6.i686.rpm python-perf-2.6.32-754.el6.i686.rpm python-perf-debuginfo-2.6.32-754.el6.i686.rpm ppc64: kernel-debug-debuginfo-2.6.32-754.el6.ppc64.rpm kernel-debuginfo-2.6.32-754.el6.ppc64.rpm kernel-debuginfo-common-ppc64-2.6.32-754.el6.ppc64.rpm perf-debuginfo-2.6.32-754.el6.ppc64.rpm python-perf-2.6.32-754.el6.ppc64.rpm python-perf-debuginfo-2.6.32-754.el6.ppc64.rpm s390x: kernel-debug-debuginfo-2.6.32-754.el6.s390x.rpm kernel-debuginfo-2.6.32-754.el6.s390x.rpm kernel-debuginfo-common-s390x-2.6.32-754.el6.s390x.rpm kernel-kdump-debuginfo-2.6.32-754.el6.s390x.rpm perf-debuginfo-2.6.32-754.el6.s390x.rpm python-perf-2.6.32-754.el6.s390x.rpm python-perf-debuginfo-2.6.32-754.el6.s390x.rpm x86_64: kernel-debug-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-common-x86_64-2.6.32-754.el6.x86_64.rpm perf-debuginfo-2.6.32-754.el6.x86_64.rpm python-perf-2.6.32-754.el6.x86_64.rpm python-perf-debuginfo-2.6.32-754.el6.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 6): Source: kernel-2.6.32-754.el6.src.rpm i386: kernel-2.6.32-754.el6.i686.rpm kernel-debug-2.6.32-754.el6.i686.rpm kernel-debug-debuginfo-2.6.32-754.el6.i686.rpm kernel-debug-devel-2.6.32-754.el6.i686.rpm kernel-debuginfo-2.6.32-754.el6.i686.rpm kernel-debuginfo-common-i686-2.6.32-754.el6.i686.rpm kernel-devel-2.6.32-754.el6.i686.rpm kernel-headers-2.6.32-754.el6.i686.rpm perf-2.6.32-754.el6.i686.rpm perf-debuginfo-2.6.32-754.el6.i686.rpm python-perf-debuginfo-2.6.32-754.el6.i686.rpm noarch: kernel-abi-whitelists-2.6.32-754.el6.noarch.rpm kernel-doc-2.6.32-754.el6.noarch.rpm kernel-firmware-2.6.32-754.el6.noarch.rpm x86_64: kernel-2.6.32-754.el6.x86_64.rpm kernel-debug-2.6.32-754.el6.x86_64.rpm kernel-debug-debuginfo-2.6.32-754.el6.i686.rpm kernel-debug-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debug-devel-2.6.32-754.el6.i686.rpm kernel-debug-devel-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-2.6.32-754.el6.i686.rpm kernel-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-common-i686-2.6.32-754.el6.i686.rpm kernel-debuginfo-common-x86_64-2.6.32-754.el6.x86_64.rpm kernel-devel-2.6.32-754.el6.x86_64.rpm kernel-headers-2.6.32-754.el6.x86_64.rpm perf-2.6.32-754.el6.x86_64.rpm perf-debuginfo-2.6.32-754.el6.i686.rpm perf-debuginfo-2.6.32-754.el6.x86_64.rpm python-perf-debuginfo-2.6.32-754.el6.i686.rpm python-perf-debuginfo-2.6.32-754.el6.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 6): i386: kernel-debug-debuginfo-2.6.32-754.el6.i686.rpm kernel-debuginfo-2.6.32-754.el6.i686.rpm kernel-debuginfo-common-i686-2.6.32-754.el6.i686.rpm perf-debuginfo-2.6.32-754.el6.i686.rpm python-perf-2.6.32-754.el6.i686.rpm python-perf-debuginfo-2.6.32-754.el6.i686.rpm x86_64: kernel-debug-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-common-x86_64-2.6.32-754.el6.x86_64.rpm perf-debuginfo-2.6.32-754.el6.x86_64.rpm python-perf-2.6.32-754.el6.x86_64.rpm python-perf-debuginfo-2.6.32-754.el6.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2012-6701 https://access.redhat.com/security/cve/CVE-2015-8830 https://access.redhat.com/security/cve/CVE-2016-8650 https://access.redhat.com/security/cve/CVE-2017-2671 https://access.redhat.com/security/cve/CVE-2017-6001 https://access.redhat.com/security/cve/CVE-2017-7308 https://access.redhat.com/security/cve/CVE-2017-7616 https://access.redhat.com/security/cve/CVE-2017-7889 https://access.redhat.com/security/cve/CVE-2017-8890 https://access.redhat.com/security/cve/CVE-2017-9075 https://access.redhat.com/security/cve/CVE-2017-9076 https://access.redhat.com/security/cve/CVE-2017-9077 https://access.redhat.com/security/cve/CVE-2017-12190 https://access.redhat.com/security/cve/CVE-2017-15121 https://access.redhat.com/security/cve/CVE-2017-18203 https://access.redhat.com/security/cve/CVE-2018-1130 https://access.redhat.com/security/cve/CVE-2018-3639 https://access.redhat.com/security/cve/CVE-2018-5803 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/security/vulnerabilities/ssbd https://access.redhat.com/documentation/en-US/red_hat_enterprise_linux/6/html/6.10_release_notes/index.html https://access.redhat.com/documentation/en-US/red_hat_enterprise_linux/6/html/6.10_technical_notes/index.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2018 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBWyiNN9zjgjWX9erEAQgn7g/8DeDvxkh3SCpVN2ma5SLYXBnG5pss2Qp7 P5a5zLae8g0OjnZMg2LoCC+Qk0Fe4mpXKB3Wu4yZmRNs7Y5WRWa4imP7ZYvLiSKa KMXLcJhZBMN16ICFw2YX9rN3+wnRC94XY9cW5x0x2uJXoBOMb0MvccLE9z5DIZ7s KI03p2JEHLMt60oZVK6Vdcs+RbfoKLgh3Z2C2ryybjl3LGO+YcqCLvDgsvXnOJl8 TBZRBBd/X6V3xld3x0N3qgPOc4uRXQuqH/QmELZAhcc0MdyhTDQV6JZsYBMV2w5n T0lo71xuPJxLZvMt8UXkQwsCWIuFMQk8uyV6mV+peXxUS0y2LUY2uwWs1AXWOUxx FfYm0jAsZW8kTLZfag9w2zWREib8bs0sx44Etz0HBs+dMHLZc7j6PvTk3zyFijSC qqk+AFGnvM76cQmP8m/SxzEr0YV5FH1wp0eJ/mdn4tl42OBu7Zu7joTI04n6DFsg 1tP5a+46eb8bFLI3FjvoN/Z3Qyaln27tVhFpTY88f3lonDDlFo8BkWNG038JxGRk R6Wjln6724pFfBT9vj+/RQFpSptFKXL3h4Fd/x+XNTFbx1dqpnVaVsstRDxOaqPO ugnRxLgzybXC1UQO0ExMu85jUM3QYLKFSv/G1dHhSsbfbOfnfbPaazpoAvClfWw5 FIbNr61v/A8= =BnkQ -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2018-10-30-9 Additional information for APPLE-SA-2018-9-24-1 macOS Mojave 10.14 macOS Mojave 10.14 addresses the following: Bluetooth Available for: iMac (21.5-inch, Late 2012), iMac (27-inch, Late 2012) , iMac (21.5-inch, Late 2013), iMac (21.5-inch, Mid 2014), iMac (Retina 5K, 27-inch, Late 2014), iMac (21.5-inch, Late 2015), Mac mini (Mid 2011), Mac mini Server (Mid 2011), Mac mini (Late 2012) , Mac mini Server (Late 2012), Mac mini (Late 2014), Mac Pro (Late 2013), MacBook Air (11-inch, Mid 2011), MacBook Air (13-inch, Mid 2011), MacBook Air (11-inch, Mid 2012), MacBook Air (13-inch, Mid 2012), MacBook Air (11-inch, Mid 2013), MacBook Air (13-inch, Mid 2013), MacBook Air (11-inch, Early 2015), MacBook Air (13-inch, Early 2015), MacBook Pro (13-inch, Mid 2012), MacBook Pro (15-inch, Mid 2012), MacBook Pro (Retina, 13-inch, Early 2013), MacBook Pro (Retina, 15-inch, Early 2013), MacBook Pro (Retina, 13-inch, Late 2013), and MacBook Pro (Retina, 15-inch, Late 2013) Impact: An attacker in a privileged network position may be able to intercept Bluetooth traffic Description: An input validation issue existed in Bluetooth. This issue was addressed with improved input validation. CVE-2018-5383: Lior Neumann and Eli Biham The updates below are available for these Mac models: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013, Mid 2010, and Mid 2012 models with recommended Metal-capable graphics processor, including MSI Gaming Radeon RX 560 and Sapphire Radeon PULSE RX 580) afpserver Impact: A remote attacker may be able to attack AFP servers through HTTP clients Description: An input validation issue was addressed with improved input validation. CVE-2018-4295: Jianjun Chen (@whucjj) from Tsinghua University and UC Berkeley Entry added October 30, 2018 App Store Impact: A malicious application may be able to determine the Apple ID of the owner of the computer Description: A permissions issue existed in the handling of the Apple ID. This issue was addressed with improved access controls. CVE-2018-4324: Sergii Kryvoblotskyi of MacPaw Inc. AppleGraphicsControl Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2018-4417: Lee of the Information Security Lab Yonsei University working with Trend Micro's Zero Day Initiative Entry added October 30, 2018 Application Firewall Impact: A sandboxed process may be able to circumvent sandbox restrictions Description: A configuration issue was addressed with additional restrictions. CVE-2018-4353: Abhinav Bansal of LinkedIn Inc. APR Impact: Multiple buffer overflow issues existed in Perl Description: Multiple issues in Perl were addressed with improved memory handling. CVE-2017-12613: Craig Young of Tripwire VERT CVE-2017-12618: Craig Young of Tripwire VERT Entry added October 30, 2018 ATS Impact: A malicious application may be able to elevate privileges Description: A memory corruption issue was addressed with improved input validation. CVE-2018-4411: lilang wu moony Li of Trend Micro working with Trend Micro's Zero Day Initiative Entry added October 30, 2018 ATS Impact: An application may be able to read restricted memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2018-4308: Mohamed Ghannam (@_simo36) Entry added October 30, 2018 Auto Unlock Impact: A malicious application may be able to access local users AppleIDs Description: A validation issue existed in the entitlement verification. This issue was addressed with improved validation of the process entitlement. CVE-2018-4321: Min (Spark) Zheng, Xiaolong Bai of Alibaba Inc. CFNetwork Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4126: Bruno Keith (@bkth_) working with Trend Micro's Zero Day Initiative Entry added October 30, 2018 CoreFoundation Impact: A malicious application may be able to elevate privileges Description: A memory corruption issue was addressed with improved input validation. CVE-2018-4412: The UK's National Cyber Security Centre (NCSC) Entry added October 30, 2018 CoreFoundation Impact: An application may be able to gain elevated privileges Description: A memory corruption issue was addressed with improved input validation. CVE-2018-4414: The UK's National Cyber Security Centre (NCSC) Entry added October 30, 2018 CoreText Impact: Processing a maliciously crafted text file may lead to arbitrary code execution Description: A use after free issue was addressed with improved memory management. CVE-2018-4347: an anonymous researcher Entry added October 30, 2018 Crash Reporter Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2018-4333: Brandon Azad CUPS Impact: In certain configurations, a remote attacker may be able to replace the message content from the print server with arbitrary content Description: An injection issue was addressed with improved validation. CVE-2018-4153: Michael Hanselmann of hansmi.ch Entry added October 30, 2018 CUPS Impact: An attacker in a privileged position may be able to perform a denial of service attack Description: A denial of service issue was addressed with improved validation. CVE-2018-4406: Michael Hanselmann of hansmi.ch Entry added October 30, 2018 Dictionary Impact: Parsing a maliciously crafted dictionary file may lead to disclosure of user information Description: A validation issue existed which allowed local file access. This was addressed with input sanitization. CVE-2018-4346: Wojciech ReguAa (@_r3ggi) of SecuRing Entry added October 30, 2018 Grand Central Dispatch Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4426: Brandon Azad Entry added October 30, 2018 Heimdal Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-3646: Baris Kasikci, Daniel Genkin, Ofir Weisse, and Thomas F. Wenisch of University of Michigan, Mark Silberstein and Marina Minkin of Technion, Raoul Strackx, Jo Van Bulck, and Frank Piessens of KU Leuven, Rodrigo Branco, Henrique Kawakami, Ke Sun, and Kekai Hu of Intel Corporation, Yuval Yarom of The University of Adelaide Entry added October 30, 2018 iBooks Impact: Parsing a maliciously crafted iBooks file may lead to disclosure of user information Description: A configuration issue was addressed with additional restrictions. CVE-2018-4355: evi1m0 of bilibili security team Entry added October 30, 2018 Intel Graphics Driver Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2018-4396: Yu Wang of Didi Research America CVE-2018-4418: Yu Wang of Didi Research America Entry added October 30, 2018 Intel Graphics Driver Impact: An application may be able to read restricted memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2018-4351: Appology Team @ Theori working with Trend Micro's Zero Day Initiative Entry added October 30, 2018 Intel Graphics Driver Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved input validation. CVE-2018-4350: Yu Wang of Didi Research America Entry added October 30, 2018 Intel Graphics Driver Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4334: Ian Beer of Google Project Zero Entry added October 30, 2018 IOHIDFamily Impact: A malicious application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved input validation CVE-2018-4408: Ian Beer of Google Project Zero Entry added October 30, 2018 IOKit Impact: A malicious application may be able to break out of its sandbox Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4341: Ian Beer of Google Project Zero CVE-2018-4354: Ian Beer of Google Project Zero Entry added October 30, 2018 IOKit Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved state management. CVE-2018-4383: Apple Entry added October 30, 2018 IOUserEthernet Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4401: Apple Entry added October 30, 2018 Kernel Impact: A malicious application may be able to leak sensitive user information Description: An access issue existed with privileged API calls. This issue was addressed with additional restrictions. CVE-2018-4399: Fabiano Anemone (@anoane) Entry added October 30, 2018 Kernel Impact: An attacker in a privileged network position may be able to execute arbitrary code Description: A memory corruption issue was addressed with improved validation. CVE-2018-4407: Kevin Backhouse of Semmle Ltd. Entry added October 30, 2018 Kernel Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4336: Brandon Azad CVE-2018-4337: Ian Beer of Google Project Zero CVE-2018-4340: Mohamed Ghannam (@_simo36) CVE-2018-4344: The UK's National Cyber Security Centre (NCSC) CVE-2018-4425: cc working with Trend Micro's Zero Day Initiative, Juwei Lin (@panicaII) of Trend Micro working with Trend Micro's Zero Day Initiative Entry added October 30, 2018 LibreSSL Impact: Multiple issues in libressl were addressed in this update Description: Multiple issues were addressed by updating to libressl version 2.6.4. CVE-2015-3194 CVE-2015-5333 CVE-2015-5334 CVE-2016-702 Entry added October 30, 2018 Login Window Impact: A local user may be able to cause a denial of service Description: A validation issue was addressed with improved logic. CVE-2018-4348: Ken Gannon of MWR InfoSecurity and Christian Demko of MWR InfoSecurity Entry added October 30, 2018 mDNSOffloadUserClient Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4326: an anonymous researcher working with Trend Micro's Zero Day Initiative, Zhuo Liang of Qihoo 360 Nirvan Team Entry added October 30, 2018 MediaRemote Impact: A sandboxed process may be able to circumvent sandbox restrictions Description: An access issue was addressed with additional sandbox restrictions. This ensures that older data read from recently-written-to addresses cannot be read via a speculative side-channel. CVE-2018-3639: Jann Horn (@tehjh) of Google Project Zero (GPZ), Ken Johnson of the Microsoft Security Response Center (MSRC) Entry added October 30, 2018 Security Impact: A local user may be able to cause a denial of service Description: This issue was addressed with improved checks. CVE-2018-4395: Patrick Wardle of Digita Security Entry added October 30, 2018 Security Impact: An attacker may be able to exploit weaknesses in the RC4 cryptographic algorithm Description: This issue was addressed by removing RC4. CVE-2016-1777: Pepi Zawodsky Spotlight Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4393: Lufeng Li Entry added October 30, 2018 Symptom Framework Impact: An application may be able to read restricted memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2018-4203: Bruno Keith (@bkth_) working with Trend Micro's Zero Day Initiative Entry added October 30, 2018 Text Impact: Processing a maliciously crafted text file may lead to a denial of service Description: A denial of service issue was addressed with improved validation. CVE-2018-4304: jianan.huang (@Sevck) Entry added October 30, 2018 Wi-Fi Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2018-4338: Lee @ SECLAB, Yonsei University working with Trend Micro's Zero Day Initiative Entry added October 30, 2018 Additional recognition Accessibility Framework We would like to acknowledge Ryan Govostes for their assistance. Core Data We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security Labs GmbH for their assistance. CoreDAV We would like to acknowledge an anonymous researcher for their assistance. CoreGraphics We would like to acknowledge Nitin Arya of Roblox Corporation for their assistance. CoreSymbolication We would like to acknowledge Brandon Azad for their assistance. IOUSBHostFamily We would like to acknowledge an anonymous researcher for their assistance. Kernel We would like to acknowledge Brandon Azad for their assistance. Mail We would like to acknowledge Alessandro Avagliano of Rocket Internet SE, John Whitehead of The New York Times, Kelvin Delbarre of Omicron Software Systems, and Zbyszek A>>A3Akiewski for their assistance. Quick Look We would like to acknowledge Wojciech ReguAa (@_r3ggi) of SecuRing and Patrick Wardle of Digita Security and lokihardt of Google Project Zero for their assistance. Security We would like to acknowledge Christoph Sinai, Daniel Dudek (@dannysapples) of The Irish Times and Filip KlubiAka (@lemoncloak) of ADAPT Centre, Dublin Institute of Technology, Istvan Csanady of Shapr3D, Omar Barkawi of ITG Software, Inc., Phil Caleno, Wilson Ding, and an anonymous researcher for their assistance. SQLite We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security Labs GmbH for their assistance. Terminal We would like to acknowledge an anonymous researcher for their assistance. WindowServer We would like to acknowledge Patrick Wardle of Digita Security for their assistance. Installation note: macOS Mojave 10.14 may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlvYkgYpHHByb2R1Y3Qt c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3GrtxAA iVBcAdusz88zFzkT05EIxb9nSp4CGOlhKlChK4N7Db17o2fNT0hNpQixEAC0wC/A zqIzsXEzZlPobI4OnwiEVs7lVBsvCW+IarrRZ8pgSllKs1VlbNfOO3z9vB5BqJMr d9PjPvtHyG3jZmWqQPIjvJb3l3ZjHAt+HAvTItNMkhIUjqV80JI8wP3erzIf3tAt VoLIw5iL5w4HAYcWsn9DYcecXZdv39MnKL5UGzMX3bkee2U7kGYtgskU+mdPa1Wl WzquIPlLeKL2KNSXEfbkPtcKM/fvkURsNzEDvg+PBQLdI3JeR1bOeN24aiTEtiEL TecGm/kKMMJWmDdhPhFvZVD+SIdZd4LgbTawR1UE1JJg7jnEZKCvZ45mXd2eBwn/ rpEKCLBsgA59GILs3ZjZSIWskRJPzZrt463AKcN2wukkTUUkY1rhRVdOf6LZMs9Z w9iJOua3vt+HzCCxTEaH53WUeM6fn/Yeq+DGIS5Fk0G09pU7tsyJVwj3o1nJn0dl e2mcrXBJeSmi6bvvkJX45y/Y8E8Qr+ovS4uN8wG6DOWcCBQkDkugabng8vNh8GST 1wNnV9JY/CmYbU0ZIwKbbSDkcQLQuIl7kKaZMHnU74EytcKscUqqx1VqINz1tssu 1wZZGLtg3VubrZOsnUZzumD+0nI8c6QAnQK3P2PSZ0k= =i9YR -----END PGP SIGNATURE----- . Description: The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems. Bug Fix(es): * Previously, using device passthrough for a SCSI-2 device failed and returned an "Illegal Request" error. With this update, the QEMU emulator checks the SCSI version of the device when performing passthrough. As a result, the described problem no longer occurs. (BZ#1571370) * Under certain circumstances, resuming a paused guest generated redundant "VIR_DOMAIN_PAUSED_UNKNOWN" error messages in the libvirt log. This update corrects the event sending order when resuming guests, which prevents the errors being logged. (BZ#1588001) 4. (CVE-2018-3639) Note: This issue is present in hardware and cannot be fully fixed via software update. The updated kernel packages provide software side of the mitigation for this hardware issue. To be fully functional, up-to-date CPU microcode applied on the system might be required. Please refer to References section for further information about this issue, CPU microcode requirements and the potential performance impact. In this update, mitigation for PowerPC architecture is provided. Bug Fix(es): These updated kernel packages include also numerous bug fixes. Space precludes documenting all of these bug fixes in this advisory. See the bug fix descriptions in the related Knowledge Article: https://access.redhat.com/articles/3449601 4. Description: The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. (CVE-2018-3639) Note: This is the OpenJDK side of the CVE-2018-3639 mitigation. Bugs fixed (https://bugzilla.redhat.com/): 1566890 - CVE-2018-3639 hw: cpu: speculative store bypass 6

IOT TAXONOMY

AFFECTED PRODUCTS