Kernel security update: CVE-2017-15274; Virtuozzo ReadyKernel patch 34.0 for Virtuozzo 7.0.x

Issue date: 2017-10-16

Applies to: Virtuozzo 7.0

Virtuozzo Advisory ID: VZA-2017-094

1. Overview

The cumulative Virtuozzo ReadyKernel patch was updated with a security fix. The patch applies to Virtuozzo kernels 3.10.0-327.18.2.vz7.15.2 (Virtuozzo 7.0.0), 3.10.0-327.36.1.vz7.18.7 (Virtuozzo 7.0.1), 3.10.0-327.36.1.vz7.20.18 (Virtuozzo 7.0.3), 3.10.0-514.16.1.vz7.30.10 (Virtuozzo 7.0.4), 3.10.0-514.16.1.vz7.30.15 (Virtuozzo 7.0.4 HF3), and 3.10.0-514.26.1.vz7.33.22 (Virtuozzo 7.0.5).

2. Security Fixes

[Moderate] A flaw was discovered in the key management subsystem of the Linux kernel. It allowed to pass NULL payload with non-zero payload length as parameters to sys_add_key() and the KEYCTL_UPDATE operation of sys_keyctl(). A local unprivileged user could exploit this to cause a kernel crash (NULL pointer dereference). (CVE-2017-15274)

3. Installing the Update

Download, install, and instantly apply the patch to the current kernel by running ‘readykernel update’.

4. References

The JSON file with the list of new and updated packages is available at JSON file.