Back to guides list

Important kernel security update: CVE-2018-5391 and other issues; new kernel 2.6.32-042stab134.3 for Virtuozzo Containers for Linux 4.7, Server Bare Metal 5.0

Issue date: 2018-10-15

Applies to: Virtuozzo Containers for Linux 4.7, Server Bare Metal 5.0

Virtuozzo Advisory ID: VZA-2018-074

1. Overview

This update provides a new kernel 2.6.32-042stab134.3 for Virtuozzo Containers for Linux 4.7 and Server Bare Metal 5.0. The new kernel introduces security and stability fixes.

2. Security Fixes

  • [Important] A flaw named FragmentSmack was found in the way the Linux kernel handled reassembly of fragmented IPv4 and IPv6 packets. A remote attacker could use this flaw to trigger time and calculation expensive fragment reassembly algorithm by sending specially crafted packets which could lead to a CPU saturation and hence a denial of service on the system. (CVE-2018-5391)

  • [Important] An integer overflow flaw was found in the Linux kernel’s create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged) binary could use this flaw to escalate their privileges on the system (Mutagen Astronomy). (CVE-2018-14634)

  • [Low] The Linux Kernel imposes a size restriction on the arguments and environmental strings passed through RLIMIT_STACK/RLIMIT_INFINITY, but does not take the argument and environment pointers into account, which allows attackers to bypass this limitation. (CVE-2017-1000365)

3. Bug Fixes

  • Under certain circumstances, ploop could crash after failed execution of kernel thread. (PSBM-88559)

  • Under certain circumstances, Acronis Backup could trigger host crash in blk_cbt_update_size(). (PSBM-88570)

  • Under certain circumstances, host could crash inside Acronis snumbd driver. (PSBM-88575)

  • Under certain circumstances, Acronis Backup could trigger host hard lockup in __cbt_flush_cpu_cache. (PSBM-89323)

  • Fixed locking in blk_release_queue() that led to hard lockup in blk_throtl_drain() (was broken in 2.6.32-754.6.3.el6 RHEL6 kernel). (PSBM-89391, RHBZ#1638926)

4. Installing the Update

The update is only available for customers subscribed to the Extended Lifecycle Support (ELS) program. These customers can download and install the update using the ‘vzup2date’ utility included in the distribution.

Nov 18, 2024
Edit Print