Synopsis
Important: kernel security and bug fix update
Type/Severity
Security Advisory: Important
Topic
An update for kernel is now available for Red Hat Enterprise Linux 6.7 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Description
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
- A use-after-free flaw was found in the way the Linux kernel's Datagram Congestion Control Protocol (DCCP) implementation freed SKB (socket buffer) resources for a DCCP_PKT_REQUEST packet when the IPV6_RECVPKTINFO option is set on the socket. A local, unprivileged user could use this flaw to alter the kernel memory, allowing them to escalate their privileges on the system. (CVE-2017-6074, Important)
Red Hat would like to thank Andrey Konovalov (Google) for reporting this issue.
Bug Fix(es):
- When an NFS server received a compound Remote Procedure Call (RPC) with multiple operations where the SECINFO operation was the ninth or later operation, the server terminated unexpectedly. This update fixes the NFS server to correctly initialize all arguments of all compound RPC operations that are beyond the first eight operations. As a result, the NFS server no longer crashes in the described situation. (BZ#1413035)
Solution
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
The system must be rebooted for this update to take effect.
Affected Products
-
Red Hat Enterprise Linux Server - Extended Update Support 6.7 x86_64
-
Red Hat Enterprise Linux Server - Extended Update Support 6.7 i386
-
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 6.7 s390x
-
Red Hat Enterprise Linux for Power, big endian - Extended Update Support 6.7 ppc64
-
Red Hat Enterprise Linux EUS Compute Node 6.7 x86_64
-
RHEL for SAP HANA - Extended Update Support 6.7 x86_64
Fixes
- BZ - 1423071 - CVE-2017-6074 kernel: use after free in dccp protocol
CVEs
References
Vulmon