CVE-2017-7477

Red Hat statement

This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG 2. This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 starting with the version kernel-3.10.0-514.el7, that is with Red Hat Enterprise Linux 7.3 GA. Prior Red Hat Enterprise Linux 7 kernel versions are not affected. In order to exploit this issue, the system needs to be manually configured by privileged user. The default Red Hat Enterprise Linux 7 configuration is not vulnerable.

Red Hat mitigation

Red Hat recommends blacklisting the kernel module to prevent its use. This will prevent accidental version loading by administration and also mitigate the flaw if a kernel with the affected module is booted. As the macsec module will be auto-loaded when required, its use can be disabled by preventing the module from loading with the following instructions: Raw # echo "install macsec /bin/true" >> /etc/modprobe.d/disable-macsec.conf If macsec functionality is in use as a functional part of the system a kernel upgrade is required.