RHSA-2018:2948 Red Hat Security Advisory: kernel-alt security, bug fix, and enhancement update
kernel: v4l2: disabled memory access protection mechanism allowing privilege escalation kernel: Use-after-free in drivers/media/dvb-core/dvb_frontend.c kernel: Salsa20 encryption algorithm does not correctly handle zero-length inputs allowing local attackers to cause denial-of-service kernel: HMAC implementation does not validate that the underlying cryptographic hash algorithm is unkeyed allowing local attackers to cause denial-of-service kernel: Mishandled freeing of instances in pcrypt.c can allow a local user to cause a denial of service kernel: Inifinite loop vulnerability in mm/madvise.c:madvise_willneed() function allows local denial of service kernel: out-of-bounds access in the show_timer function in kernel/time/posix-timers.c kernel: netfilter: xtables NULL pointer dereference in ip6_tables.c:ip6t_do_table() leading to a crash kernel: Out-of-bounds write via userland offsets in ebt_entry struct in netfilter/ebtables.c kernel: NULL pointer dereference in ext4/mballoc.c:ext4_process_freed_data() when mounting crafted ext4 image kernel: NULL pointer dereference in ext4/xattr.c:ext4_xattr_inode_hash() causes crash with crafted ext4 image kernel: out-of-bound access in fs/posix_acl.c:get_acl() causes crash with crafted ext4 image kernel: vhost: Information disclosure in vhost/vhost.c:vhost_new_msg() kernel: fuse-backed file mmap-ed onto process cmdline arguments causes denial of service hw: cpu: speculative store bypass kernel: drivers/block/loop.c mishandles lo_release serialization allowing denial-of-service kernel: TCP segments with random offsets allow a remote denial of service (SegmentSmack) kernel: IP fragments with random offsets allow a remote denial of service (FragmentSmack) kernel: Kernel address information leak in drivers/acpi/sbshc.c:acpi_smbus_hc_add() function potentially allowing KASLR bypass kernel: Missing length check of payload in net/sctp/sm_make_chunk.c:_sctp_make_chunk() function allows denial of service kernel: buffer overflow in drivers/net/wireless/ath/wil6210/wmi.c:wmi_set_ie() may lead to memory corruption kernel: race condition in snd_seq_write() may lead to UAF or OOB-access kernel: Memory leak in the sas_smp_get_phy_events function in drivers/scsi/libsas/sas_expander.c kernel: Integer overflow in drivers/gpu/drm/udl/udl_fb.c:udl_fb_mmap() can allow attackers to execute code in kernel space kernel: Buffer overflow in hidp_process_report kernel: Invalid pointer dereference in xfs_ilock_attr_map_shared() when mounting crafted xfs image allowing denial of service kernel: out-of-bound access in ext4_ext_drop_refs function with a crafted ext4 image kernel: out-of-bound write in ext4_init_block_bitmap function with a crafted ext4 image kernel: use-after-free detected in ext4_xattr_set_entry with a crafted file kernel: stack-out-of-bounds write in ext4_update_inline_data function kernel: out-of-bound access in ext4_get_group_info() when mounting and operating a crafted ext4 image kernel: stack-out-of-bounds write infs/jbd2/transaction.c kernel: stack-out-of-bounds write in jbd2_journal_dirty_metadata function kernel: incorrect memory bounds check in drivers/cdrom/cdrom.c kernel: Stack-based buffer overflow in drivers/scsi/sr_ioctl.c allows denial of service or other unspecified impact kernel: NULL pointer dereference if close and fchownat system calls share a socket file descriptor kernel: Missing check in fs/inode.c:inode_init_owner() does not clear SGID bit on non-directories for non-members kernel: crash (possible privesc) in kernel crypto api. kernel: a bug in ip_frag_reasm() can cause a crash in ip_do_fragment() kernel: Improper validation in bnx2x network card driver can allow for denial of service attacks via crafted packet kernel: NULL pointer dereference on OOM kill of large mlocked process kernel: Infoleak caused by incorrect handling of the SG_IO ioctl
CVSS v3.0 score: 4.1