Important kernel security update: CVE-2018-13405 and other; Virtuozzo ReadyKernel patch 55.0 for all supported Virtuozzo 7.0 kernels¶
Issue date: 2018-08-02
Applies to: Virtuozzo 7.0
Virtuozzo Advisory ID: VZA-2018-049
The cumulative Virtuozzo ReadyKernel patch was updated with security and stability fixes. The patch applies to all supported Virtuozzo 7.0 kernels.
2. Security Fixes¶
[Important] It was discovered that the local users could create files with an unintended group ownership and with group execution and SGID permission bits set. It was possible when a directory was SGID, belonged to a certain group and was writable by a user who was not a member of this group. This could lead to excessive permissions granted in case when they should not. (CVE-2018-13405)
[Moderate] A flaw was discovered in the implementation of SCTP protocol. A local unprivileged user could exploit it to cause soft lockups in the kernel (and, eventually, a denial of service) using specially crafted sequences of system calls. (PSBM-86804)
3. Bug Fixes¶
Kernel warning in kill_block_super() when a mount operation fails. (PSBM-80743)
It was discovered that the system could fail to restore a container (‘VZctlError: Not enough system resources’) if the container had more mounts than one third of the limit shown in /proc/sys/fs/ve-mount-nr. (PSBM-86511)
Missing unlock_page() in the error path in fuse_readpages_fill(). (PSBM-86790)
4. Installing the Update¶
Download, install, and immediately apply the patch to the current kernel by running ‘readykernel update’.
The JSON file with the list of new and updated packages is available at http://docs.virtuozzo.com/vza/VZA-2018-049.json.