RHSA-2020:2851: Important: kernel security and bug fix update
The kernel packages contain the Linux kernel, the core of any Linux operating system.Security Fix(es): kernel: Count overflow in FUSE request leading to use-after-free issues. (CVE-2019-11487) Kernel: KVM: OOB memory access via mmio ring buffer (CVE-2019-14821) Kernel: vfio: access to disabled MMIO space of some devices may lead to DoS scenario (CVE-2020-12888) kernel: denial of service via ioctl call in network tun handling (CVE-2018-7191) kernel: usb: missing size check in the usbgetextradescriptor() leading to DoS (CVE-2018-20169) kernel: perfeventopen() and execve() race in setuid programs allows a data leak (CVE-2019-3901) kernel: use-after-free in arch/x86/lib/insn-eval.c (CVE-2019-13233) kernel: memory leak in registerqueuekobjects() in net/core/net-sysfs.c leads to denial of service (CVE-2019-15916) kernel: powerpc: incomplete Spectre-RSB mitigation leads to information exposure (CVE-2019-18660) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Bug Fix(es): kernel: hw: provide reporting and microcode mitigation toggle for CVE-2020-0543 / Special Register Buffer Data Sampling (SRBDS) (BZ#1840677)
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2020:2851?
The severity of RHSA-2020:2851 is typically categorized as critical due to the potential for system crashes and remote code execution.
How do I fix RHSA-2020:2851?
To address RHSA-2020:2851, update to the patched kernel version 3.10.0-957.56.1.el7 or later.
What vulnerabilities are addressed in RHSA-2020:2851?
RHSA-2020:2851 addresses vulnerabilities including CVE-2019-11487, which involves a count overflow in FUSE requests, and CVE-2019-14821, related to out-of-bounds memory access.
What are the affected software packages in RHSA-2020:2851?
The affected software packages include kernel, kernel-debug, kernel-devel, and several others based on Red Hat's repository.
Is RHSA-2020:2851 applicable to all Linux distributions?
No, RHSA-2020:2851 is specifically applicable to Red Hat Enterprise Linux versions that utilize the specified kernel version.