Synopsis: Important: kernel security and bug fix update
Advisory ID: SLSA-2015:2552-1
Issue Date: 2015-12-08
CVE Numbers: CVE-2015-5307
CVE-2015-8104
--
* It was found that the x86 ISA (Instruction Set Architecture) is prone to
a denial of service attack inside a virtualized environment in the form of
an infinite loop in the microcode due to the way (sequential) delivering
of benign exceptions such as #AC (alignment check exception) and #DB
(debug exception) is handled. A privileged user inside a guest could use
these flaws to create denial of service conditions on the host kernel.
(CVE-2015-5307, CVE-2015-8104, Important)
This update also fixes the following bugs:
* On Intel Xeon v5 platforms, the processor frequency was always tied to
the highest possible frequency. Switching p-states on these client
platforms failed. This update sets the idle frequency, busy frequency, and
processor frequency values by determining the range and adjusting the
minimal and maximal percent limit values. Now, switching p-states on the
aforementioned client platforms proceeds successfully.
* Due to a validation error of in-kernel memory-mapped I/O (MMIO) tracing,
a VM became previously unresponsive when connected to RHEV Hypervisor. The
provided patch fixes this bug by dropping the check in MMIO handler, and a
VM continues running as expected.
* Due to retry-able command errors, the NVMe driver previously leaked I/O
descriptors and DMA mappings. As a consequence, the kernel could become
unresponsive during the hot-unplug operation if a driver was removed. This
update fixes the driver memory leak bug on command retries, and the kernel
no longer hangs in this situation.
* The hybrid_dma_data() function was not initialized before use, which
caused an invalid memory access when hot-plugging a PCI card. As a
consequence, a kernel oops occurred. The provided patch makes sure
hybrid_dma_data() is initialized before use, and the kernel oops no longer
occurs in this situation.
* When running PowerPC (PPC) KVM guests and the host was experiencing a
lot of page faults, for example because it was running low on memory, the
host sometimes triggered an incorrect kind of interrupt in the guest: a
data storage exception instead of a data segment exception. This caused a
kernel panic of the PPC KVM guest. With this update, the host kernel
synthesizes a segment fault if the corresponding Segment Lookaside Buffer
(SLB) lookup fails, which prevents the kernel panic from occurring.
* The kernel accessed an incorrect area of the khugepaged process causing
Logical Partitioning (LPAR) to become unresponsive, and an oops occurred
in medlp5. The backported upstream patch prevents an LPAR hang, and the
oops no longer occurs.
* When the sctp module was loaded and a route to an association endpoint
was removed after receiving an Out-of-The-Blue (OOTB) chunk but before
incrementing the "dropped because of missing route" SNMP statistic, a Null
Pointer Dereference kernel panic previously occurred. This update fixes
the race condition between OOTB response and route removal.
* The cpuscaling test of the certification test suite previously failed
due to a rounding bug in the intel-pstate driver. This bug has been fixed
and the cpuscaling test now passes.
The system must be rebooted for this update to take effect.
--
SL7
x86_64
kernel-3.10.0-327.3.1.el7.x86_64.rpm
kernel-debug-3.10.0-327.3.1.el7.x86_64.rpm
kernel-debug-debuginfo-3.10.0-327.3.1.el7.x86_64.rpm
kernel-debug-devel-3.10.0-327.3.1.el7.x86_64.rpm
kernel-debuginfo-3.10.0-327.3.1.el7.x86_64.rpm
kernel-debuginfo-common-x86_64-3.10.0-327.3.1.el7.x86_64.rpm
kernel-devel-3.10.0-327.3.1.el7.x86_64.rpm
kernel-headers-3.10.0-327.3.1.el7.x86_64.rpm
kernel-tools-3.10.0-327.3.1.el7.x86_64.rpm
kernel-tools-debuginfo-3.10.0-327.3.1.el7.x86_64.rpm
kernel-tools-libs-3.10.0-327.3.1.el7.x86_64.rpm
perf-3.10.0-327.3.1.el7.x86_64.rpm
perf-debuginfo-3.10.0-327.3.1.el7.x86_64.rpm
python-perf-3.10.0-327.3.1.el7.x86_64.rpm
python-perf-debuginfo-3.10.0-327.3.1.el7.x86_64.rpm
kernel-tools-libs-devel-3.10.0-327.3.1.el7.x86_64.rpm
noarch
kernel-abi-whitelists-3.10.0-327.3.1.el7.noarch.rpm
kernel-doc-3.10.0-327.3.1.el7.noarch.rpm
- Scientific Linux Development Team
|
