RHSA-2017:2669HighCVSS 8.6

Red Hat Security Advisory: kernel-rt security and bug fix update

Published
September 6, 2017
Last Modified
November 5, 2026

🔗 CVE IDs covered (25)

CVE-2016-10741 →CVE-2017-7533 →CVE-2017-9074 →CVE-2017-9077 →CVE-2016-7042 →CVE-2016-7097 →CVE-2016-9685 →CVE-2016-9806 →CVE-2017-2671 →CVE-2017-6001 →CVE-2017-7187 →CVE-2017-7495 →CVE-2015-8839 →CVE-2017-5551 →CVE-2017-5970 →CVE-2016-9576 →CVE-2016-9604 →CVE-2017-6951 →CVE-2017-7889 →CVE-2017-8797 →CVE-2017-8890 →CVE-2017-9075 →CVE-2017-9076 →CVE-2016-8645 →CVE-2016-10088 →

📋 Description

CVE-2015-8839 — kernel: ext4 filesystem page fault race condition with fallocate call. CVE-2016-7042 — kernel: Stack corruption while reading /proc/keys when gcc stack protector is enabled CVE-2016-7097 — kernel: Setting a POSIX ACL via setxattr doesn't clear the setgid bit CVE-2016-8645 — kernel: a BUG() statement can be hit in net/ipv4/tcp_input.c CVE-2016-9576 — kernel: Use after free in SCSI generic device interface CVE-2016-9604 — kernel: security: The built-in keyrings for security tokens can be joined as a session and then modified by the root user CVE-2016-9685 — kernel: Memory leaks in xfs_attr_list.c error paths CVE-2016-9806 — kernel: netlink: double-free in netlink_dump CVE-2016-10088 — kernel: Use after free in SCSI generic device interface (CVE-2016-9576 regression) CVE-2016-10741 — kernel: race condition between direct and memory-mapped I/O in fs/xfs/xfs_aops.c CVE-2017-2671 — kernel: ping socket / AF_LLC connect() sin_family race CVE-2017-5551 — kernel: S_ISGD is not cleared when setting posix ACLs in tmpfs (CVE-2016-7097 incomplete fix) CVE-2017-5970 — kernel: ipv4: Invalid IP options could cause skb->dst drop CVE-2017-6001 — kernel: Race condition between multiple sys_perf_event_open() calls CVE-2017-6951 — kernel: NULL pointer dereference in keyring_search_aux function CVE-2017-7187 — kernel: scsi: Stack-based buffer overflow in sg_ioctl function CVE-2017-7495 — kernel: ext4: power failure during write(2) causes on-disk information leak CVE-2017-7533 — kernel: a race between inotify_handle_event() and sys_rename() CVE-2017-7889 — kernel: mm subsystem does not properly enforce the CONFIG_STRICT_DEVMEM protection mechanism CVE-2017-8797 — kernel: NFSv4 server does not properly validate layout type when processing NFSv4 pNFS LAYOUTGET operand CVE-2017-8890 — kernel: Double free in the inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c CVE-2017-9074 — kernel: net: IPv6 fragmentation implementation of nexthdr field may be associated with an invalid option CVE-2017-9075 — kernel: net: sctp_v6_create_accept_sk function mishandles inheritance CVE-2017-9076 — kernel: net: IPv6 DCCP implementation mishandles inheritance CVE-2017-9077 — kernel: net: tcp_v6_syn_recv_sock function mishandles inheritance

🎯 Affected products17

  • Red Hat MRG Realtime for RHEL 6 Server v.2
  • kernel-rt-1:3.10.0-693.2.1.rt56.585.el6rt.src as a component of Red Hat MRG Realtime for RHEL 6 Server v.2
  • kernel-rt-1:3.10.0-693.2.1.rt56.585.el6rt.x86_64 as a component of Red Hat MRG Realtime for RHEL 6 Server v.2
  • kernel-rt-debug-1:3.10.0-693.2.1.rt56.585.el6rt.x86_64 as a component of Red Hat MRG Realtime for RHEL 6 Server v.2
  • kernel-rt-debug-debuginfo-1:3.10.0-693.2.1.rt56.585.el6rt.x86_64 as a component of Red Hat MRG Realtime for RHEL 6 Server v.2
  • kernel-rt-debug-devel-1:3.10.0-693.2.1.rt56.585.el6rt.x86_64 as a component of Red Hat MRG Realtime for RHEL 6 Server v.2
  • kernel-rt-debuginfo-1:3.10.0-693.2.1.rt56.585.el6rt.x86_64 as a component of Red Hat MRG Realtime for RHEL 6 Server v.2
  • kernel-rt-debuginfo-common-x86_64-1:3.10.0-693.2.1.rt56.585.el6rt.x86_64 as a component of Red Hat MRG Realtime for RHEL 6 Server v.2
  • kernel-rt-devel-1:3.10.0-693.2.1.rt56.585.el6rt.x86_64 as a component of Red Hat MRG Realtime for RHEL 6 Server v.2
  • kernel-rt-doc-1:3.10.0-693.2.1.rt56.585.el6rt.noarch as a component of Red Hat MRG Realtime for RHEL 6 Server v.2
  • kernel-rt-firmware-1:3.10.0-693.2.1.rt56.585.el6rt.noarch as a component of Red Hat MRG Realtime for RHEL 6 Server v.2
  • kernel-rt-trace-1:3.10.0-693.2.1.rt56.585.el6rt.x86_64 as a component of Red Hat MRG Realtime for RHEL 6 Server v.2
  • kernel-rt-trace-debuginfo-1:3.10.0-693.2.1.rt56.585.el6rt.x86_64 as a component of Red Hat MRG Realtime for RHEL 6 Server v.2
  • kernel-rt-trace-devel-1:3.10.0-693.2.1.rt56.585.el6rt.x86_64 as a component of Red Hat MRG Realtime for RHEL 6 Server v.2
  • kernel-rt-vanilla-1:3.10.0-693.2.1.rt56.585.el6rt.x86_64 as a component of Red Hat MRG Realtime for RHEL 6 Server v.2
  • kernel-rt-vanilla-debuginfo-1:3.10.0-693.2.1.rt56.585.el6rt.x86_64 as a component of Red Hat MRG Realtime for RHEL 6 Server v.2
  • kernel-rt-vanilla-devel-1:3.10.0-693.2.1.rt56.585.el6rt.x86_64 as a component of Red Hat MRG Realtime for RHEL 6 Server v.2

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Workaround: Alternative filesystems may be used in place of ext4 in case of sensitive data leak. Alternatively, don't hard reset the system.

🔗 References (27)