Red Hat Security Advisory: kernel security and bug fix update
An update for kernel is now available for Red Hat Enterprise Linux 8.1 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
describes (4)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-12352US | medium6.5 | Exploit | ||
Improper access control in BlueZ may allow an unauthenticated user to potentially enable information disclosure via adjacent access. | ||||
| CVE-2020-12351US | high8.8 | Exploit | ||
Improper input validation in BlueZ may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access. | ||||
| CVE-2020-14386US | high7.8 | Exploit | ||
A flaw was found in the Linux kernel before 5.9-rc4. Memory corruption can be exploited to gain root privileges from unprivileged processes. The highest threat from this vulnerabil… | ||||
| CVE-2020-14385US | medium5.5 | — | ||
A flaw was found in the Linux kernel before 5.9-rc4. A failure of the file system metadata validator in XFS can cause an inode with a valid, user-creatable extended attribute to be… | ||||
references
External citations — patches, advisories, analysis.
- https://access.redhat.com/errata/RHSA-2020:4287self
- https://access.redhat.com/security/updates/classification/#importantexternal
- https://access.redhat.com/security/vulnerabilities/BleedingToothexternal
- 1874800external
- 1875699external
- 1886521external
- 1886529external
- Canonical URLself
remediations (960)
- Fixedbpftool-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedbpftool-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedbpftool-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedbpftool-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedbpftool-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedbpftool-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedbpftool-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedbpftool-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedbpftool-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedbpftool-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedbpftool-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedbpftool-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedbpftool-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedbpftool-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedbpftool-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedbpftool-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-0:4.18.0-147.32.1.el8_1.src as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-0:4.18.0-147.32.1.el8_1.src as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-0:4.18.0-147.32.1.el8_1.src as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-0:4.18.0-147.32.1.el8_1.src as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-abi-whitelists-0:4.18.0-147.32.1.el8_1.noarch as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-abi-whitelists-0:4.18.0-147.32.1.el8_1.noarch as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-abi-whitelists-0:4.18.0-147.32.1.el8_1.noarch as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-abi-whitelists-0:4.18.0-147.32.1.el8_1.noarch as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-core-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-core-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-core-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-core-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-core-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-core-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-core-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-core-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-core-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-core-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-core-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-core-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-core-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-core-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-core-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-core-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-core-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-core-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-core-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-core-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-core-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-core-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-core-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-core-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-core-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-core-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-core-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-core-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-core-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-core-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-core-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-core-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-devel-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-devel-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-devel-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-devel-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-devel-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-devel-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-devel-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-devel-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-devel-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-devel-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-devel-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-devel-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-devel-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-devel-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-devel-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-devel-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-modules-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-modules-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-modules-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-modules-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-modules-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-modules-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-modules-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-modules-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-modules-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-modules-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-modules-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-modules-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-modules-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-modules-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-modules-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-modules-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-modules-extra-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-modules-extra-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-modules-extra-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-modules-extra-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-modules-extra-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-modules-extra-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-modules-extra-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-modules-extra-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-modules-extra-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-modules-extra-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-modules-extra-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-modules-extra-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-modules-extra-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-modules-extra-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-modules-extra-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debug-modules-extra-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-common-aarch64-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-common-aarch64-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-common-aarch64-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-common-aarch64-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-common-aarch64-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-common-aarch64-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-common-aarch64-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-common-aarch64-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-common-ppc64le-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-common-ppc64le-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-common-ppc64le-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-common-ppc64le-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-common-ppc64le-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-common-ppc64le-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-common-ppc64le-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-common-ppc64le-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-common-s390x-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-common-s390x-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-common-s390x-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-common-s390x-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-common-x86_64-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-common-x86_64-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-common-x86_64-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-common-x86_64-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-common-x86_64-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-common-x86_64-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-common-x86_64-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-debuginfo-common-x86_64-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-devel-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-devel-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-devel-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-devel-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-devel-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-devel-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-devel-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-devel-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-devel-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-devel-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-devel-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-devel-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-devel-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-devel-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-devel-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-devel-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-doc-0:4.18.0-147.32.1.el8_1.noarch as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-doc-0:4.18.0-147.32.1.el8_1.noarch as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-doc-0:4.18.0-147.32.1.el8_1.noarch as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-doc-0:4.18.0-147.32.1.el8_1.noarch as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-modules-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-modules-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-modules-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-modules-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-modules-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-modules-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-modules-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-modules-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-modules-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-modules-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-modules-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-modules-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-modules-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-modules-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-modules-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-modules-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-modules-extra-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-modules-extra-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-modules-extra-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-modules-extra-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-modules-extra-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-modules-extra-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-modules-extra-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-modules-extra-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-modules-extra-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-modules-extra-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-modules-extra-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-modules-extra-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-modules-extra-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-modules-extra-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-modules-extra-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-modules-extra-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-libs-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-libs-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-libs-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-libs-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-libs-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-libs-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-libs-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-libs-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-libs-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-libs-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-libs-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-libs-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-libs-devel-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-libs-devel-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-libs-devel-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-libs-devel-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-libs-devel-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-libs-devel-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-libs-devel-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-libs-devel-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-libs-devel-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-libs-devel-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-libs-devel-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-tools-libs-devel-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-zfcpdump-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-zfcpdump-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-zfcpdump-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-zfcpdump-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-zfcpdump-core-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-zfcpdump-core-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-zfcpdump-core-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-zfcpdump-core-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-zfcpdump-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-zfcpdump-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-zfcpdump-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-zfcpdump-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-zfcpdump-devel-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-zfcpdump-devel-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-zfcpdump-devel-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-zfcpdump-devel-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-zfcpdump-modules-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-zfcpdump-modules-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-zfcpdump-modules-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-zfcpdump-modules-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-zfcpdump-modules-extra-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-zfcpdump-modules-extra-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-zfcpdump-modules-extra-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedkernel-zfcpdump-modules-extra-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedperf-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedperf-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedperf-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedperf-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedperf-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedperf-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedperf-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedperf-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedperf-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedperf-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedperf-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedperf-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedperf-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedperf-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedperf-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedperf-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedperf-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedperf-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedperf-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedperf-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedperf-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedperf-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedperf-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedperf-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedperf-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedperf-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedperf-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedperf-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedperf-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedperf-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedperf-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedperf-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedperf-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedperf-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedperf-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedperf-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedperf-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedperf-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedperf-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedperf-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedperf-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedperf-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedperf-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedperf-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedpython3-perf-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedpython3-perf-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedpython3-perf-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedpython3-perf-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedpython3-perf-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedpython3-perf-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedpython3-perf-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedpython3-perf-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedpython3-perf-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedpython3-perf-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedpython3-perf-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedpython3-perf-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedpython3-perf-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedpython3-perf-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedpython3-perf-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedpython3-perf-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Fixedpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287 - Workaroundbpftool-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundbpftool-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundbpftool-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundbpftool-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundbpftool-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundbpftool-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundbpftool-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundbpftool-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundbpftool-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundbpftool-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundbpftool-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundbpftool-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundbpftool-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundbpftool-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundbpftool-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundbpftool-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-0:4.18.0-147.32.1.el8_1.src as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-0:4.18.0-147.32.1.el8_1.src as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-0:4.18.0-147.32.1.el8_1.src as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-0:4.18.0-147.32.1.el8_1.src as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-abi-whitelists-0:4.18.0-147.32.1.el8_1.noarch as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-abi-whitelists-0:4.18.0-147.32.1.el8_1.noarch as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-abi-whitelists-0:4.18.0-147.32.1.el8_1.noarch as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-abi-whitelists-0:4.18.0-147.32.1.el8_1.noarch as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-core-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-core-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-core-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-core-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-core-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-core-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-core-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-core-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-core-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-core-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-core-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-core-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-core-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-core-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-core-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-core-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-debug-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-debug-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-debug-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-debug-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-debug-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-debug-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-debug-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-debug-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-core-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-debug-core-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-debug-core-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-core-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-core-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-debug-core-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-debug-core-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-core-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-core-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-debug-core-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-debug-core-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-core-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-core-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-debug-core-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-debug-core-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-core-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-devel-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-debug-devel-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-debug-devel-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-devel-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-devel-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-debug-devel-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-debug-devel-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-devel-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-devel-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-debug-devel-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-debug-devel-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-devel-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-devel-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-debug-devel-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-debug-devel-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-devel-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-modules-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-debug-modules-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-debug-modules-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-modules-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-modules-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-debug-modules-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-debug-modules-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-modules-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-modules-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-debug-modules-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-debug-modules-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-modules-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-modules-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-debug-modules-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-debug-modules-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-modules-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-modules-extra-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-debug-modules-extra-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-debug-modules-extra-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-modules-extra-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-modules-extra-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-debug-modules-extra-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-debug-modules-extra-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-modules-extra-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-modules-extra-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-debug-modules-extra-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-debug-modules-extra-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-modules-extra-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-modules-extra-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-debug-modules-extra-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-debug-modules-extra-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debug-modules-extra-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debuginfo-common-aarch64-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-debuginfo-common-aarch64-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-debuginfo-common-aarch64-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debuginfo-common-aarch64-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debuginfo-common-aarch64-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-debuginfo-common-aarch64-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-debuginfo-common-aarch64-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debuginfo-common-aarch64-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debuginfo-common-ppc64le-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-debuginfo-common-ppc64le-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-debuginfo-common-ppc64le-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debuginfo-common-ppc64le-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debuginfo-common-ppc64le-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-debuginfo-common-ppc64le-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-debuginfo-common-ppc64le-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debuginfo-common-ppc64le-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debuginfo-common-s390x-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-debuginfo-common-s390x-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-debuginfo-common-s390x-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debuginfo-common-s390x-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debuginfo-common-x86_64-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-debuginfo-common-x86_64-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-debuginfo-common-x86_64-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debuginfo-common-x86_64-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debuginfo-common-x86_64-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-debuginfo-common-x86_64-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-debuginfo-common-x86_64-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-debuginfo-common-x86_64-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-devel-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-devel-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-devel-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-devel-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-devel-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-devel-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-devel-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-devel-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-devel-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-devel-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-devel-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-devel-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-devel-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-devel-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-devel-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-devel-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-doc-0:4.18.0-147.32.1.el8_1.noarch as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-doc-0:4.18.0-147.32.1.el8_1.noarch as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-doc-0:4.18.0-147.32.1.el8_1.noarch as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-doc-0:4.18.0-147.32.1.el8_1.noarch as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-modules-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-modules-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-modules-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-modules-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-modules-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-modules-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-modules-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-modules-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-modules-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-modules-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-modules-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-modules-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-modules-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-modules-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-modules-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-modules-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-modules-extra-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-modules-extra-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-modules-extra-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-modules-extra-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-modules-extra-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-modules-extra-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-modules-extra-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-modules-extra-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-modules-extra-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-modules-extra-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-modules-extra-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-modules-extra-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-modules-extra-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-modules-extra-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-modules-extra-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-modules-extra-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-tools-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-tools-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-tools-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-tools-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-tools-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-tools-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-tools-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-tools-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-tools-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-tools-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-tools-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-tools-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-tools-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-tools-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-tools-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-tools-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-tools-libs-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-tools-libs-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-tools-libs-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-tools-libs-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-tools-libs-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-tools-libs-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-tools-libs-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-tools-libs-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-tools-libs-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-tools-libs-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-tools-libs-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-tools-libs-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-tools-libs-devel-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-tools-libs-devel-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-tools-libs-devel-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-tools-libs-devel-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-tools-libs-devel-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-tools-libs-devel-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-tools-libs-devel-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-tools-libs-devel-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-tools-libs-devel-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-tools-libs-devel-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-tools-libs-devel-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-tools-libs-devel-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-zfcpdump-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-zfcpdump-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-zfcpdump-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-zfcpdump-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-zfcpdump-core-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-zfcpdump-core-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-zfcpdump-core-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-zfcpdump-core-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-zfcpdump-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-zfcpdump-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-zfcpdump-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-zfcpdump-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-zfcpdump-devel-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-zfcpdump-devel-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-zfcpdump-devel-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-zfcpdump-devel-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-zfcpdump-modules-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-zfcpdump-modules-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-zfcpdump-modules-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-zfcpdump-modules-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-zfcpdump-modules-extra-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundkernel-zfcpdump-modules-extra-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundkernel-zfcpdump-modules-extra-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundkernel-zfcpdump-modules-extra-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundperf-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundperf-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundperf-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundperf-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundperf-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundperf-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundperf-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundperf-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundperf-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundperf-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundperf-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundperf-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundperf-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundperf-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundperf-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundperf-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundperf-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundperf-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundperf-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundperf-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundperf-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundperf-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundperf-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundperf-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundperf-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundperf-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundperf-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundperf-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundperf-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundperf-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundperf-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundperf-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundperf-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundperf-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundperf-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundperf-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundperf-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundperf-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundperf-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundperf-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundperf-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundperf-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundperf-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundperf-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundpython3-perf-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundpython3-perf-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundpython3-perf-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundpython3-perf-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundpython3-perf-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundpython3-perf-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundpython3-perf-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundpython3-perf-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundpython3-perf-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundpython3-perf-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundpython3-perf-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundpython3-perf-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundpython3-perf-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundpython3-perf-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundpython3-perf-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundpython3-perf-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
- Workaroundpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- Workaroundpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
- Workaroundpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan