-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

====================================================================                   Red Hat Security Advisory

Synopsis:          Important: kernel security and bug fix update
Advisory ID:       RHSA-2017:3200-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://access.redhat.com/errata/RHSA-2017:3200
Issue date:        2017-11-14
CVE Names:         CVE-2017-14106 CVE-2017-1000111 CVE-2017-1000112 
====================================================================
1. Summary:

An update for kernel is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Desktop (v. 6) - i386, noarch, x86_64
Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64
Red Hat Enterprise Linux HPC Node (v. 6) - noarch, x86_64
Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64
Red Hat Enterprise Linux Server (v. 6) - i386, noarch, ppc64, s390x, x86_64
Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux Workstation (v. 6) - i386, noarch, x86_64
Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64

3. Description:

The kernel packages contain the Linux kernel, the core of any Linux
operating system.

Security Fix(es):

* A race condition issue leading to a use-after-free flaw was found in the
way the raw packet sockets are implemented in the Linux kernel networking
subsystem handling synchronization. A local user able to open a raw packet
socket (requires the CAP_NET_RAW capability) could use this flaw to elevate
their privileges on the system. (CVE-2017-1000111, Important)

* An exploitable memory corruption flaw was found in the Linux kernel. The
append path can be erroneously switched from UFO to non-UFO in
ip_ufo_append_data() when building an UFO packet with MSG_MORE option. If
unprivileged user namespaces are available, this flaw can be exploited to
gain root privileges. (CVE-2017-1000112, Important)

* A divide-by-zero vulnerability was found in the __tcp_select_window
function in the Linux kernel. This can result in a kernel panic causing a
local denial of service. (CVE-2017-14106, Moderate)

Red Hat would like to thank Willem de Bruijn for reporting CVE-2017-1000111
and Andrey Konovalov for reporting CVE-2017-1000112.

Bug Fix(es):

* When the operating system was booted with Red Hat Enterprise
Virtualization, and the eh_deadline sysfs parameter was set to 10s, the
Storage Area Network (SAN) issues caused eh_deadline to trigger with no
handler. Consequently, a kernel panic occurred. This update fixes the lpfc
driver, thus preventing the kernel panic under described circumstances.
(BZ#1487220)

* When an NFS server returned the NFS4ERR_BAD_SEQID error to an OPEN
request, the open-owner was removed from the state_owners rbtree.
Consequently, NFS4 client infinite loop that required a reboot to recover
occurred. This update changes NFS4ERR_BAD_SEQID handling to leave the
open-owner in the state_owners rbtree by updating the create_time parameter
so that it looks like a new open-owner. As a result, an NFS4 client is now
able to recover without falling into the infinite recovery loop after
receiving NFS4ERR_BAD_SEQID. (BZ#1491123)

* If an NFS client attempted to mount NFSv3 shares from an NFS server
exported directly to the client's IP address, and this NFS client had
already mounted other shares that originated from the same server but were
exported to the subnetwork which this client was part of, the auth.unix.ip
cache expiration was not handled correctly. Consequently, the client
received the 'stale file handle' errors when trying to mount the share.
This update fixes handling of the cache expiration, and the NFSv3 shares
now mount as expected without producing the 'stale file handle' errors.
(BZ#1497976)

* When running a script that raised the tx ring count to its maximum value
supported by the Solarflare Network Interface Controller (NIC) driver, the
EF10 family NICs allowed the settings exceeding the hardware's capability.
Consequently, the Solarflare hardware became unusable with Red Hat
Entepripse Linux 6. This update fixes the sfc driver, so that the tx ring
can have maximum 2048 entries for all EF10 NICs. As a result, the
Solarflare hardware no longer becomes unusable with Red Hat Entepripse
Linux 6 due to this bug. (BZ#1498019)

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

1479304 - CVE-2017-1000111 kernel: Heap out-of-bounds in AF_PACKET sockets
1479307 - CVE-2017-1000112 kernel: Exploitable memory corruption due to UFO to non-UFO path switch
1487295 - CVE-2017-14106 kernel: Divide-by-zero in __tcp_select_window

6. Package List:

Red Hat Enterprise Linux Desktop (v. 6):

Source:
kernel-2.6.32-696.16.1.el6.src.rpm

i386:
kernel-2.6.32-696.16.1.el6.i686.rpm
kernel-debug-2.6.32-696.16.1.el6.i686.rpm
kernel-debug-debuginfo-2.6.32-696.16.1.el6.i686.rpm
kernel-debug-devel-2.6.32-696.16.1.el6.i686.rpm
kernel-debuginfo-2.6.32-696.16.1.el6.i686.rpm
kernel-debuginfo-common-i686-2.6.32-696.16.1.el6.i686.rpm
kernel-devel-2.6.32-696.16.1.el6.i686.rpm
kernel-headers-2.6.32-696.16.1.el6.i686.rpm
perf-2.6.32-696.16.1.el6.i686.rpm
perf-debuginfo-2.6.32-696.16.1.el6.i686.rpm
python-perf-debuginfo-2.6.32-696.16.1.el6.i686.rpm

noarch:
kernel-abi-whitelists-2.6.32-696.16.1.el6.noarch.rpm
kernel-doc-2.6.32-696.16.1.el6.noarch.rpm
kernel-firmware-2.6.32-696.16.1.el6.noarch.rpm

x86_64:
kernel-2.6.32-696.16.1.el6.x86_64.rpm
kernel-debug-2.6.32-696.16.1.el6.x86_64.rpm
kernel-debug-debuginfo-2.6.32-696.16.1.el6.i686.rpm
kernel-debug-debuginfo-2.6.32-696.16.1.el6.x86_64.rpm
kernel-debug-devel-2.6.32-696.16.1.el6.i686.rpm
kernel-debug-devel-2.6.32-696.16.1.el6.x86_64.rpm
kernel-debuginfo-2.6.32-696.16.1.el6.i686.rpm
kernel-debuginfo-2.6.32-696.16.1.el6.x86_64.rpm
kernel-debuginfo-common-i686-2.6.32-696.16.1.el6.i686.rpm
kernel-debuginfo-common-x86_64-2.6.32-696.16.1.el6.x86_64.rpm
kernel-devel-2.6.32-696.16.1.el6.x86_64.rpm
kernel-headers-2.6.32-696.16.1.el6.x86_64.rpm
perf-2.6.32-696.16.1.el6.x86_64.rpm
perf-debuginfo-2.6.32-696.16.1.el6.i686.rpm
perf-debuginfo-2.6.32-696.16.1.el6.x86_64.rpm
python-perf-debuginfo-2.6.32-696.16.1.el6.i686.rpm
python-perf-debuginfo-2.6.32-696.16.1.el6.x86_64.rpm

Red Hat Enterprise Linux Desktop Optional (v. 6):

i386:
kernel-debug-debuginfo-2.6.32-696.16.1.el6.i686.rpm
kernel-debuginfo-2.6.32-696.16.1.el6.i686.rpm
kernel-debuginfo-common-i686-2.6.32-696.16.1.el6.i686.rpm
perf-debuginfo-2.6.32-696.16.1.el6.i686.rpm
python-perf-2.6.32-696.16.1.el6.i686.rpm
python-perf-debuginfo-2.6.32-696.16.1.el6.i686.rpm

x86_64:
kernel-debug-debuginfo-2.6.32-696.16.1.el6.x86_64.rpm
kernel-debuginfo-2.6.32-696.16.1.el6.x86_64.rpm
kernel-debuginfo-common-x86_64-2.6.32-696.16.1.el6.x86_64.rpm
perf-debuginfo-2.6.32-696.16.1.el6.x86_64.rpm
python-perf-2.6.32-696.16.1.el6.x86_64.rpm
python-perf-debuginfo-2.6.32-696.16.1.el6.x86_64.rpm

Red Hat Enterprise Linux HPC Node (v. 6):

Source:
kernel-2.6.32-696.16.1.el6.src.rpm

noarch:
kernel-abi-whitelists-2.6.32-696.16.1.el6.noarch.rpm
kernel-doc-2.6.32-696.16.1.el6.noarch.rpm
kernel-firmware-2.6.32-696.16.1.el6.noarch.rpm

x86_64:
kernel-2.6.32-696.16.1.el6.x86_64.rpm
kernel-debug-2.6.32-696.16.1.el6.x86_64.rpm
kernel-debug-debuginfo-2.6.32-696.16.1.el6.i686.rpm
kernel-debug-debuginfo-2.6.32-696.16.1.el6.x86_64.rpm
kernel-debug-devel-2.6.32-696.16.1.el6.i686.rpm
kernel-debug-devel-2.6.32-696.16.1.el6.x86_64.rpm
kernel-debuginfo-2.6.32-696.16.1.el6.i686.rpm
kernel-debuginfo-2.6.32-696.16.1.el6.x86_64.rpm
kernel-debuginfo-common-i686-2.6.32-696.16.1.el6.i686.rpm
kernel-debuginfo-common-x86_64-2.6.32-696.16.1.el6.x86_64.rpm
kernel-devel-2.6.32-696.16.1.el6.x86_64.rpm
kernel-headers-2.6.32-696.16.1.el6.x86_64.rpm
perf-2.6.32-696.16.1.el6.x86_64.rpm
perf-debuginfo-2.6.32-696.16.1.el6.i686.rpm
perf-debuginfo-2.6.32-696.16.1.el6.x86_64.rpm
python-perf-debuginfo-2.6.32-696.16.1.el6.i686.rpm
python-perf-debuginfo-2.6.32-696.16.1.el6.x86_64.rpm

Red Hat Enterprise Linux HPC Node Optional (v. 6):

x86_64:
kernel-debug-debuginfo-2.6.32-696.16.1.el6.x86_64.rpm
kernel-debuginfo-2.6.32-696.16.1.el6.x86_64.rpm
kernel-debuginfo-common-x86_64-2.6.32-696.16.1.el6.x86_64.rpm
perf-debuginfo-2.6.32-696.16.1.el6.x86_64.rpm
python-perf-2.6.32-696.16.1.el6.x86_64.rpm
python-perf-debuginfo-2.6.32-696.16.1.el6.x86_64.rpm

Red Hat Enterprise Linux Server (v. 6):

Source:
kernel-2.6.32-696.16.1.el6.src.rpm

i386:
kernel-2.6.32-696.16.1.el6.i686.rpm
kernel-debug-2.6.32-696.16.1.el6.i686.rpm
kernel-debug-debuginfo-2.6.32-696.16.1.el6.i686.rpm
kernel-debug-devel-2.6.32-696.16.1.el6.i686.rpm
kernel-debuginfo-2.6.32-696.16.1.el6.i686.rpm
kernel-debuginfo-common-i686-2.6.32-696.16.1.el6.i686.rpm
kernel-devel-2.6.32-696.16.1.el6.i686.rpm
kernel-headers-2.6.32-696.16.1.el6.i686.rpm
perf-2.6.32-696.16.1.el6.i686.rpm
perf-debuginfo-2.6.32-696.16.1.el6.i686.rpm
python-perf-debuginfo-2.6.32-696.16.1.el6.i686.rpm

noarch:
kernel-abi-whitelists-2.6.32-696.16.1.el6.noarch.rpm
kernel-doc-2.6.32-696.16.1.el6.noarch.rpm
kernel-firmware-2.6.32-696.16.1.el6.noarch.rpm

ppc64:
kernel-2.6.32-696.16.1.el6.ppc64.rpm
kernel-bootwrapper-2.6.32-696.16.1.el6.ppc64.rpm
kernel-debug-2.6.32-696.16.1.el6.ppc64.rpm
kernel-debug-debuginfo-2.6.32-696.16.1.el6.ppc64.rpm
kernel-debug-devel-2.6.32-696.16.1.el6.ppc64.rpm
kernel-debuginfo-2.6.32-696.16.1.el6.ppc64.rpm
kernel-debuginfo-common-ppc64-2.6.32-696.16.1.el6.ppc64.rpm
kernel-devel-2.6.32-696.16.1.el6.ppc64.rpm
kernel-headers-2.6.32-696.16.1.el6.ppc64.rpm
perf-2.6.32-696.16.1.el6.ppc64.rpm
perf-debuginfo-2.6.32-696.16.1.el6.ppc64.rpm
python-perf-debuginfo-2.6.32-696.16.1.el6.ppc64.rpm

s390x:
kernel-2.6.32-696.16.1.el6.s390x.rpm
kernel-debug-2.6.32-696.16.1.el6.s390x.rpm
kernel-debug-debuginfo-2.6.32-696.16.1.el6.s390x.rpm
kernel-debug-devel-2.6.32-696.16.1.el6.s390x.rpm
kernel-debuginfo-2.6.32-696.16.1.el6.s390x.rpm
kernel-debuginfo-common-s390x-2.6.32-696.16.1.el6.s390x.rpm
kernel-devel-2.6.32-696.16.1.el6.s390x.rpm
kernel-headers-2.6.32-696.16.1.el6.s390x.rpm
kernel-kdump-2.6.32-696.16.1.el6.s390x.rpm
kernel-kdump-debuginfo-2.6.32-696.16.1.el6.s390x.rpm
kernel-kdump-devel-2.6.32-696.16.1.el6.s390x.rpm
perf-2.6.32-696.16.1.el6.s390x.rpm
perf-debuginfo-2.6.32-696.16.1.el6.s390x.rpm
python-perf-debuginfo-2.6.32-696.16.1.el6.s390x.rpm

x86_64:
kernel-2.6.32-696.16.1.el6.x86_64.rpm
kernel-debug-2.6.32-696.16.1.el6.x86_64.rpm
kernel-debug-debuginfo-2.6.32-696.16.1.el6.i686.rpm
kernel-debug-debuginfo-2.6.32-696.16.1.el6.x86_64.rpm
kernel-debug-devel-2.6.32-696.16.1.el6.i686.rpm
kernel-debug-devel-2.6.32-696.16.1.el6.x86_64.rpm
kernel-debuginfo-2.6.32-696.16.1.el6.i686.rpm
kernel-debuginfo-2.6.32-696.16.1.el6.x86_64.rpm
kernel-debuginfo-common-i686-2.6.32-696.16.1.el6.i686.rpm
kernel-debuginfo-common-x86_64-2.6.32-696.16.1.el6.x86_64.rpm
kernel-devel-2.6.32-696.16.1.el6.x86_64.rpm
kernel-headers-2.6.32-696.16.1.el6.x86_64.rpm
perf-2.6.32-696.16.1.el6.x86_64.rpm
perf-debuginfo-2.6.32-696.16.1.el6.i686.rpm
perf-debuginfo-2.6.32-696.16.1.el6.x86_64.rpm
python-perf-debuginfo-2.6.32-696.16.1.el6.i686.rpm
python-perf-debuginfo-2.6.32-696.16.1.el6.x86_64.rpm

Red Hat Enterprise Linux Server Optional (v. 6):

i386:
kernel-debug-debuginfo-2.6.32-696.16.1.el6.i686.rpm
kernel-debuginfo-2.6.32-696.16.1.el6.i686.rpm
kernel-debuginfo-common-i686-2.6.32-696.16.1.el6.i686.rpm
perf-debuginfo-2.6.32-696.16.1.el6.i686.rpm
python-perf-2.6.32-696.16.1.el6.i686.rpm
python-perf-debuginfo-2.6.32-696.16.1.el6.i686.rpm

ppc64:
kernel-debug-debuginfo-2.6.32-696.16.1.el6.ppc64.rpm
kernel-debuginfo-2.6.32-696.16.1.el6.ppc64.rpm
kernel-debuginfo-common-ppc64-2.6.32-696.16.1.el6.ppc64.rpm
perf-debuginfo-2.6.32-696.16.1.el6.ppc64.rpm
python-perf-2.6.32-696.16.1.el6.ppc64.rpm
python-perf-debuginfo-2.6.32-696.16.1.el6.ppc64.rpm

s390x:
kernel-debug-debuginfo-2.6.32-696.16.1.el6.s390x.rpm
kernel-debuginfo-2.6.32-696.16.1.el6.s390x.rpm
kernel-debuginfo-common-s390x-2.6.32-696.16.1.el6.s390x.rpm
kernel-kdump-debuginfo-2.6.32-696.16.1.el6.s390x.rpm
perf-debuginfo-2.6.32-696.16.1.el6.s390x.rpm
python-perf-2.6.32-696.16.1.el6.s390x.rpm
python-perf-debuginfo-2.6.32-696.16.1.el6.s390x.rpm

x86_64:
kernel-debug-debuginfo-2.6.32-696.16.1.el6.x86_64.rpm
kernel-debuginfo-2.6.32-696.16.1.el6.x86_64.rpm
kernel-debuginfo-common-x86_64-2.6.32-696.16.1.el6.x86_64.rpm
perf-debuginfo-2.6.32-696.16.1.el6.x86_64.rpm
python-perf-2.6.32-696.16.1.el6.x86_64.rpm
python-perf-debuginfo-2.6.32-696.16.1.el6.x86_64.rpm

Red Hat Enterprise Linux Workstation (v. 6):

Source:
kernel-2.6.32-696.16.1.el6.src.rpm

i386:
kernel-2.6.32-696.16.1.el6.i686.rpm
kernel-debug-2.6.32-696.16.1.el6.i686.rpm
kernel-debug-debuginfo-2.6.32-696.16.1.el6.i686.rpm
kernel-debug-devel-2.6.32-696.16.1.el6.i686.rpm
kernel-debuginfo-2.6.32-696.16.1.el6.i686.rpm
kernel-debuginfo-common-i686-2.6.32-696.16.1.el6.i686.rpm
kernel-devel-2.6.32-696.16.1.el6.i686.rpm
kernel-headers-2.6.32-696.16.1.el6.i686.rpm
perf-2.6.32-696.16.1.el6.i686.rpm
perf-debuginfo-2.6.32-696.16.1.el6.i686.rpm
python-perf-debuginfo-2.6.32-696.16.1.el6.i686.rpm

noarch:
kernel-abi-whitelists-2.6.32-696.16.1.el6.noarch.rpm
kernel-doc-2.6.32-696.16.1.el6.noarch.rpm
kernel-firmware-2.6.32-696.16.1.el6.noarch.rpm

x86_64:
kernel-2.6.32-696.16.1.el6.x86_64.rpm
kernel-debug-2.6.32-696.16.1.el6.x86_64.rpm
kernel-debug-debuginfo-2.6.32-696.16.1.el6.i686.rpm
kernel-debug-debuginfo-2.6.32-696.16.1.el6.x86_64.rpm
kernel-debug-devel-2.6.32-696.16.1.el6.i686.rpm
kernel-debug-devel-2.6.32-696.16.1.el6.x86_64.rpm
kernel-debuginfo-2.6.32-696.16.1.el6.i686.rpm
kernel-debuginfo-2.6.32-696.16.1.el6.x86_64.rpm
kernel-debuginfo-common-i686-2.6.32-696.16.1.el6.i686.rpm
kernel-debuginfo-common-x86_64-2.6.32-696.16.1.el6.x86_64.rpm
kernel-devel-2.6.32-696.16.1.el6.x86_64.rpm
kernel-headers-2.6.32-696.16.1.el6.x86_64.rpm
perf-2.6.32-696.16.1.el6.x86_64.rpm
perf-debuginfo-2.6.32-696.16.1.el6.i686.rpm
perf-debuginfo-2.6.32-696.16.1.el6.x86_64.rpm
python-perf-debuginfo-2.6.32-696.16.1.el6.i686.rpm
python-perf-debuginfo-2.6.32-696.16.1.el6.x86_64.rpm

Red Hat Enterprise Linux Workstation Optional (v. 6):

i386:
kernel-debug-debuginfo-2.6.32-696.16.1.el6.i686.rpm
kernel-debuginfo-2.6.32-696.16.1.el6.i686.rpm
kernel-debuginfo-common-i686-2.6.32-696.16.1.el6.i686.rpm
perf-debuginfo-2.6.32-696.16.1.el6.i686.rpm
python-perf-2.6.32-696.16.1.el6.i686.rpm
python-perf-debuginfo-2.6.32-696.16.1.el6.i686.rpm

x86_64:
kernel-debug-debuginfo-2.6.32-696.16.1.el6.x86_64.rpm
kernel-debuginfo-2.6.32-696.16.1.el6.x86_64.rpm
kernel-debuginfo-common-x86_64-2.6.32-696.16.1.el6.x86_64.rpm
perf-debuginfo-2.6.32-696.16.1.el6.x86_64.rpm
python-perf-2.6.32-696.16.1.el6.x86_64.rpm
python-perf-debuginfo-2.6.32-696.16.1.el6.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2017-14106
https://access.redhat.com/security/cve/CVE-2017-1000111
https://access.redhat.com/security/cve/CVE-2017-1000112
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2017 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iD8DBQFaDArIXlSAg2UNWIIRAi5yAJwPcea+LOAY8YRgk9+lge9ft6riYwCgvxbU
IWqUGR5V5IqbbbtVWOPNqXo=l9Go
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce