Lucene search

K
centosCentOS ProjectCESA-2016:2962
HistoryDec 20, 2016 - 5:00 p.m.

kernel security update

2016-12-2017:00:55
CentOS Project
lists.centos.org
85

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.038 Low

EPSS

Percentile

91.9%

CentOS Errata and Security Advisory CESA-2016:2962

The kernel packages contain the Linux kernel, the core of any Linux operating
system.

Security Fix(es):

  • A use-after-free vulnerability was found in the kernels socket recvmmsg
    subsystem. This may allows remote attackers to corrupt memory and may allow
    execution of arbitrary code. This corruption takes place during the error
    handling routines within __sys_recvmmsg() function. (CVE-2016-7117, Important)

Bug Fix(es):

  • Previously, guest virtual machines (VMs) on a Hyper-V server cluster got in
    some cases rebooted during the graceful node failover test, because the host
    kept sending heartbeat packets independently of guests responding to them. This
    update fixes the bug by properly responding to all the heartbeat messages in the
    queue, even if they are pending. As a result, guest VMs no longer get rebooted
    under the described circumstances. (BZ#1391167)

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2016-December/084344.html

Affected packages:
kernel
kernel-PAE
kernel-PAE-devel
kernel-debug
kernel-debug-devel
kernel-devel
kernel-doc
kernel-headers
kernel-xen
kernel-xen-devel

Upstream details at:
https://access.redhat.com/errata/RHSA-2016:2962

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.038 Low

EPSS

Percentile

91.9%