RHSA-2020:4332HighCVSS 7.8

Red Hat Security Advisory: kpatch-patch security update

Published
October 26, 2020
Last Modified
November 6, 2026

🔗 CVE IDs covered (2)

CVE-2020-14385 →CVE-2020-14386 →

📋 Description

CVE-2020-14385 — kernel: metadata validator in XFS may cause an inode with a valid, user-creatable extended attribute to be flagged as corrupt CVE-2020-14386 — kernel: memory corruption in net/packet/af_packet.c leads to elevation of privilege

🎯 Affected products55

  • Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
  • kpatch-patch-4_18_0-147-0:1-18.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
  • kpatch-patch-4_18_0-147-0:1-18.el8.src as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
  • kpatch-patch-4_18_0-147-0:1-18.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
  • kpatch-patch-4_18_0-147-debuginfo-0:1-18.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
  • kpatch-patch-4_18_0-147-debuginfo-0:1-18.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
  • kpatch-patch-4_18_0-147-debugsource-0:1-18.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
  • kpatch-patch-4_18_0-147-debugsource-0:1-18.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
  • kpatch-patch-4_18_0-147_0_2-0:1-14.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
  • kpatch-patch-4_18_0-147_0_2-0:1-14.el8.src as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
  • kpatch-patch-4_18_0-147_0_2-0:1-14.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
  • kpatch-patch-4_18_0-147_0_2-debuginfo-0:1-14.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
  • kpatch-patch-4_18_0-147_0_2-debuginfo-0:1-14.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
  • kpatch-patch-4_18_0-147_0_2-debugsource-0:1-14.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
  • kpatch-patch-4_18_0-147_0_2-debugsource-0:1-14.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
  • kpatch-patch-4_18_0-147_0_3-0:1-14.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
  • kpatch-patch-4_18_0-147_0_3-0:1-14.el8.src as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
  • kpatch-patch-4_18_0-147_0_3-0:1-14.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
  • kpatch-patch-4_18_0-147_13_2-0:1-5.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
  • kpatch-patch-4_18_0-147_13_2-0:1-5.el8_1.src as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
  • kpatch-patch-4_18_0-147_13_2-0:1-5.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
  • kpatch-patch-4_18_0-147_13_2-debuginfo-0:1-5.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
  • kpatch-patch-4_18_0-147_13_2-debuginfo-0:1-5.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
  • kpatch-patch-4_18_0-147_13_2-debugsource-0:1-5.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
  • kpatch-patch-4_18_0-147_13_2-debugsource-0:1-5.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
  • kpatch-patch-4_18_0-147_20_1-0:1-4.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
  • kpatch-patch-4_18_0-147_20_1-0:1-4.el8_1.src as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
  • kpatch-patch-4_18_0-147_20_1-0:1-4.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
  • kpatch-patch-4_18_0-147_20_1-debuginfo-0:1-4.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
  • kpatch-patch-4_18_0-147_20_1-debuginfo-0:1-4.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
  • +25 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html

🔗 References (5)