Important kernel security update: Virtuozzo ReadyKernel patch 97.0 for Virtuozzo 7.0, Virtuozzo Infrastructure Platform 2.5, 3.0 and Virtuozzo Infrastructure 3.5

Issue date: 2020-02-10

Applies to: Virtuozzo 7.0, Virtuozzo Infrastructure Platform 2.5, Virtuozzo Infrastructure Platform 3.0, Virtuozzo Infrastructure 3.5

Virtuozzo Advisory ID: VZA-2020-013

1. Overview

The cumulative Virtuozzo ReadyKernel patch was updated with security and stability fixes. The patch applies to the kernels 3.10.0-862.9.1.vz7.63.3 (Virtuozzo 7.0.8), 3.10.0-862.11.6.vz7.64.7 (Virtuozzo 7.0.8 HF1), 3.10.0-862.20.2.vz7.73.24 (Virtuozzo 7.0.9 and Virtuozzo Infrastructure Platform 2.5), 3.10.0-862.20.2.vz7.73.29 (Virtuozzo 7.0.9 and Virtuozzo Infrastructure Platform 2.5), 3.10.0-957.10.1.vz7.85.17 (Virtuozzo 7.0.10), 3.10.0-957.12.2.vz7.86.2 (Virtuozzo 7.0.10 HF1), 3.10.0-957.12.2.vz7.96.21 (Virtuozzo 7.0.11 and Virtuozzo Infrastructure Platform 3.0), 3.10.0-1062.4.2.vz7.116.7 (Virtuozzo 7.0.12 HF1 and Virtuozzo Infrastructure 3.5).

2. Security Fixes

[Important] [3.10.0-862.9.1.vz7.63.3 to 3.10.0-862.20.2.vz7.73.29] Use-after-free in fs/xfs/xfs_super.c. A flaw was found in the implementation of XFS filesystem where a key data structure (sb->s_fs_info) may not be de-allocated properly when the system is under memory pressure. This could allow a local attacker to create a use-after-free situation which can result in memory corruption or, potentially, privilege escalation. (CVE-2018-20976)
[Moderate] [3.10.0-862.9.1.vz7.63.3 to 3.10.0-1062.4.2.vz7.116.7] Kernel crash due to out-of-bounds memory accesses in process_vm_readv(). It was discovered that the implementation of process_vm_readv() system call could try to access memory outside of the structures it was processing in certain cases. A local unprivileged user could use this vulnerability to crash the system. (PSBM-94695)

3. Bug Fixes

[3.10.0-957.12.2.vz7.96.21 to 3.10.0-1062.4.2.vz7.116.7] Certain operations with an empty ploop image could lead to its unexpected growth. (PSBM-101143)
[3.10.0-1062.4.2.vz7.116.7] quotaoff operation executed in a container could get stuck in D state. (PSBM-101159)
[3.10.0-1062.4.2.vz7.116.7] Incomplete fix for PSBM-100575: reading of /proc/bc/resources line by line would never end. (PSBM-101249)

4. Installing the Update

Download, install, and immediately apply the patch to the current kernel by running ‘readykernel update’.

5. References

The JSON file with the list of new and updated packages is available at JSON file.