An important Linux kernel security update has been released for RHEL (Red Hat Enterprise Linux) 6 and CentOS 6 systems to address two vulnerabilities and a couple of bugs.
Red Hat Product Security team informs of a new, important Linux kernel security update for all supported Red Hat Enterprise Linux 6 products to address a buffer overflow issue (CVE-2019-17133) found in the generic WiFi ESSID handling implementation. This could allow a system to join a wireless network with an ESSID longer than 32 characters, which could crash the machine.
The second vulnerability (CVE-2019-17055) patched in this kernel update was found in Linux kernel’s AF_ISDN protocol implementation, which could allow unprivileged users to create a raw socket to control the availability of an existing ISDN circuit. The only mitigation for this flaw is blacklisting the kernel module from being loaded.
Furthermore, the kernel update for Red Hat Enterprise Linux 6 systems addresses two bugs, one that made the LACP bond to fail to work because the bonding driver sees slave speed and duplex as “Unknown”, and another one affecting the ixgbevf guess, which could cause excessive interrupts in the hypervisor due to get link settings.
Affected products include Red Hat Enterprise Linux Server 6 (x86_64 and i386), Red Hat Enterprise Linux Workstation 6 (x86_64 and i386), Red Hat Enterprise Linux Desktop 6 (x86_64 and i386), Red Hat Enterprise Linux for IBM z Systems 6 (s390x), Red Hat Enterprise Linux for Power, big endian 6 (ppc64), Red Hat Enterprise Linux for Scientific Computing 6 (x86_64), and CentOS 6 (x86_64 and i386).
All users are urged to update their RHEL 6 and CentOS 6 systems to the Linux kernels kernel-2.6.32-754.28.1.el6.x86_64.rpm on x86_64 and kernel-2.6.32-754.28.1.el6.i686.rpm on i386 as soon as possible. Please keep in mind to reboot your machines after installing the new kernel versions for the bugs and flaws to be correctly patched.
Last updated 8 months ago