[Important] [Security] Virtuozzo ReadyKernel Patch 158.1 for Virtuozzo Server 7.5

Issue date: 2023-07-24

Applies to: Virtuozzo Server 7.5

Virtuozzo Advisory ID: VZA-2023-020

1. Overview

The cumulative Virtuozzo ReadyKernel patch was updated with security fixes. The patch applies to all supported kernels of Virtuozzo Server 7.5.

2. Security Fixes

• [Important] [3.10.0-1160.41.1.vz7.183.5 to 3.10.0-1160.80.1.vz7.191.4] A use-after-free while changing the network packet scheduler. (CVE-2023-0590)
• [Important] [3.10.0-1160.41.1.vz7.183.5 to 3.10.0-1160.80.1.vz7.191.4] A null pointer dereference in traffic control when assigning classes to noqueue disciplines. (CVE-2022-47929)
• [Important] [3.10.0-1160.41.1.vz7.183.5 to 3.10.0-1160.80.1.vz7.191.4] A null pointer dereference caused by a race during updating nftables. (CVE-2023-1095)

3. Installing the Update

Download, install, and immediately apply the patch to the current kernel by running readykernel update.

4. References

• https://readykernel.com/patch/Virtuozzo-7/readykernel-patch-191.4-158.1-1.vl7/
• https://readykernel.com/patch/Virtuozzo-7/readykernel-patch-185.3-158.1-1.vl7/
• https://readykernel.com/patch/Virtuozzo-7/readykernel-patch-183.5-158.1-1.vl7/

The new and updated packages are listed in the JSON file.