Important kernel security update: CVE-2018-13405 and other; Virtuozzo ReadyKernel patch 55.0 for all supported Virtuozzo 7.0 kernels

Issue date: 2018-08-02

Applies to: Virtuozzo 7.0

Virtuozzo Advisory ID: VZA-2018-049

1. Overview

The cumulative Virtuozzo ReadyKernel patch was updated with security and stability fixes. The patch applies to all supported Virtuozzo 7.0 kernels.

[Important] It was discovered that the local users could create files with an unintended group ownership and with group execution and SGID permission bits set. It was possible when a directory was SGID, belonged to a certain group and was writable by a user who was not a member of this group. This could lead to excessive permissions granted in case when they should not. (CVE-2018-13405)
[Moderate] A flaw was discovered in the implementation of SCTP protocol. A local unprivileged user could exploit it to cause soft lockups in the kernel (and, eventually, a denial of service) using specially crafted sequences of system calls. (PSBM-86804)

Kernel warning in kill_block_super() when a mount operation fails. (PSBM-80743)
It was discovered that the system could fail to restore a container (‘VZctlError: Not enough system resources’) if the container had more mounts than one third of the limit shown in /proc/sys/fs/ve-mount-nr. (PSBM-86511)
Missing unlock_page() in the error path in fuse_readpages_fill(). (PSBM-86790)

Download, install, and immediately apply the patch to the current kernel by running ‘readykernel update’.

The JSON file with the list of new and updated packages is available at JSON file.