[Important] [Security] Virtuozzo ReadyKernel Patch 162.0 for Virtuozzo Server 7.5

Issue date: 2023-10-12

Applies to: Virtuozzo Server 7.5

Virtuozzo Advisory ID: VZA-2023-029

1. Overview

The cumulative Virtuozzo ReadyKernel patch was updated with security fixes. The patch applies to all supported kernels of Virtuozzo Server 7.5.

2. Security Fixes

• [Important] [3.10.0-1160.53.1.vz7.185.3 to 3.10.0-1160.90.1.vz7.200.7] Out-of-bounds memory access in the ipset module. (CVE-2023-42753)
• [Important] [3.10.0-1160.53.1.vz7.185.3 to 3.10.0-1160.90.1.vz7.200.7] Invalid memory access in the RSVP traffic classifier. (CVE-2023-42755)
• [Important] [3.10.0-1160.53.1.vz7.185.3 to 3.10.0-1160.90.1.vz7.200.7] A use-after-free in the classifiers ‘cls_fw,’ ‘cls_u32,’ and ‘cls_route.’ (CVE-2023-4128)

3. Installing the Update

Download, install, and immediately apply the patch to the current kernel by running readykernel update.

4. References

• https://readykernel.com/patch/Virtuozzo-7/readykernel-patch-200.7-162.0-1.vl7/
• https://readykernel.com/patch/Virtuozzo-7/readykernel-patch-191.4-162.0-1.vl7/
• https://readykernel.com/patch/Virtuozzo-7/readykernel-patch-185.3-162.0-1.vl7/

The new and updated packages are listed in the JSON file.