Back to guides list

Kernel security update: CVE-2017-18017 and other; new kernel 2.6.32-042stab128.2, Virtuozzo 6.0 Update 12 Hotfix 22 (6.0.12-3701)

Issue date: 2018-03-26

Applies to: Virtuozzo 6.0

Virtuozzo Advisory ID: VZA-2018-017

1. Overview

This update provides a new Virtuozzo 6.0 kernel 2.6.32-042stab128.2 that introduces security and stability fixes and is a rebase to the Red Hat Enterprise Linux 6.9 kernel 2.6.32-696.23.1.el6. This kernel was recompiled by the updated gcc with retpolines support. Retpolines are a technique used by the kernel to reduce overhead of mitigating Spectre Variant 2 attacks described in CVE-2017-5715. In addition, the update features a non-kernel fix for VSTOR-7228.

2. Security Fixes

  • [Moderate] In the Linux kernel through 4.14.13, the rds_message_alloc_sgs() function does not validate a value that is used during DMA page allocation, leading to a heap-based out-of-bounds write (related to the rds_rdma_extra_size() function in ‘net/rds/rdma.c’) and thus to a system panic. (CVE-2018-5332)

  • [Moderate] The rds_cmsg_atomic() function in ‘net/rds/rdma.c’ mishandles cases where page pinning fails or an invalid address is supplied by a user. This can lead to a NULL pointer dereference in rds_atomic_free_op() and thus to a system panic. (CVE-2018-5333)

  • [Moderate] The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c allows remote attackers to cause a denial of service (use-after-free and memory corruption) or possibly have unspecified other impact by leveraging the presence of xt_TCPMSS in an iptables action. (CVE-2017-18017)

3. Bug Fixes

  • Fixed compilation warning in ip_map_cached_get(). (PSBM-80063)

  • nfs server kernel thread running on host was crashed in vzquota_dparent_check_same(). (PSBM-80879)

  • Minor ploop improvements. (PSBM-81964)

  • [Non-kernel] pstorage top/stat commands did not show all CSes. (VSTOR-7228)

4. Installing the Update

Install the update by running ‘yum update’.

Nov 18, 2024
Edit Print