Users of the Red Hat Enterprise Linux 6 and CentOS Linux 6 operating system series received important kernel security updates that patch some recently discovered vulnerabilities.
Now that Red Hat Enterprise Linux 7 and CentOS Linux 7 operating system series were patched against the Spectre Variant 4 (CVE-2018-3639) security vulnerability, as well as the Lazy FPU State Save/Restore CPU flaw, it’s time for Red Hat Enterprise Linux 6 and CentOS Linux 6 to receive these important security updates, which users can now install them on their computers.
As expected, the most important fix is that for Spectre Variant 4, an industry-wide CPU flaw that affects numerous modern microprocessor using a common performance optimization known as speculative execution of Load & Store instructions, which could allow an unprivileged attacker to read privileged memory via targeted cache side-channel attacks. Patches are now available for Intel x86 and AMD CPUs.
The Lazy FPU state save/restore CPU flaw (CVE-2018-3665) was patched as well in this latest kernel security update to the Red Hat Enterprise Linux 6 and CentOS Linux 6 operating system series, which could lead to leakage of FPU state information. Additionally, the new kernel updates also address a use-after-free vulnerability in the mm/mempolicy.c:do_get_mempolicy function (CVE-2018-10675), which could lead to local denial of service attacks.
Also fixed is a kernel error in exception handling (CVE-2018-8897 regression and CVE-2018-10872), which could also lead to denial of service attacks. Red Hat Enterprise Linux 6 users are urged to update their installations as soon as possible, and CentOS Linux 6 users should update their systems as well to kernel-2.6.32-754.2.1.el6.i686.rpm on 32-bit and kernel-2.6.32-754.2.1.el6.x86_64.rpm on 64-bit.
Source: https://news.softpedia.com/news/red-hat-enterprise-linux-6-centos-6-patched-against-spectre-v4-lazy-fpu-flaws-521965.shtml
submitted by: Arnfried Walbrecht
Comments are closed.