Kernel security update: CVE-2017-7645 and other; new kernel 2.6.32-042stab123.3 for Virtuozzo Containers for Linux 4.7, Server Bare Metal 5.0

Issue date: 2017-05-11

Applies to: Virtuozzo Containers for Linux 4.7, Server Bare Metal 5.0

Virtuozzo Advisory ID: VZA-2017-036

1. Overview

This update provides a new kernel 2.6.32-042stab123.3 for Virtuozzo Containers for Linux 4.7, Server Bare Metal 5.0. The new kernel is based on the Red Hat Enterprise Linux 6.9 kernel 2.6.32-696.el6 and provides security fixes as well as stability bug fixes.

2. Security Fixes

[Important] The NFSv2 and NFSv3 server implementations in the Linux kernel through 4.10.13 lack certain checks for the end of a buffer. A remote attacker could trigger a pointer-arithmetic error or possibly have unspecified other impact via crafted requests related to fs/nfsd/nfs3xdr.c and fs/nfsd/nfsxdr.c. (CVE-2017-7895)
[Important] The NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel through 4.10.11 allowed remote attackers to cause a denial of service (system crash) via a long RPC reply, related to net/sunrpc/svc.c, fs/nfsd/nfs3xdr.c, and fs/nfsd/nfsxdr.c. (CVE-2017-7645)

3. Bug Fixes

Node with containers running over an NFS share could crash during container resize operations. A degradation in 042stab123.x kernels. (PSBM-65555)
Under certain rare conditions, if host resources were lacking, starting a container with NFS support could crash the host. All 042stab kernels were affected. (PSBM-65550)

4. Installing the Update

Install the update with the ‘vzup2date’ utility included in the distribution.

5. References

The JSON file with the list of new and updated packages is available at JSON file.