-
PSBM-121833
nfsd: Potential kernel crash in nfs4_put_stid().
-
PSBM-121772
'ploop grow' operation could fail in certain cases if the ploop image file contained holes.
-
PSBM-121523
Processes being killed by the OOM killer could continue consuming memory.
If a process running in a container performed large allocations of kernel memory, this could hit the memory limit for the container and trigger the OOM killer. It was discovered, however, that the process being killed by it could continue consuming memory for some time. This could lead to out of memory conditions on the host.
-
PSBM-106785
bcache: Potential kernel crash when using RAID1 as a backing device.
-
PSBM-108276
ploop: Potential kernel crash or data corruption during backups due to racy operations with lockout data.
-
PSBM-108091
netfilter/ipset: excessive memory consumption leading to a denial of service.
If was discovered that not all memory allocated for ipset-related data was properly accounted for. An attacker could exploit it from a container to consume lots of kernel memory, making the host system unusable (denial of service).
-
CVE-2020-25212
NFS v4: potential memory corruption on the client system when processing security attributes.
It was discovered that a buffer overflow and memory corruption were possible if a system tried to mount an NFS v4 share where the files had security labels in the file attributes. An attacker would need to control the NFS server and make it send a specific series of responses to trigger the issue. The issue allows the attacker to crash the kernel on the client system or, potentially, escalate their privileges there.
https://access.redhat.com/security/cve/CVE-2020-25212
-
CVE-2020-25211
netfilter: kernel crash due to a buffer overflow in ctnetlink_parse_tuple_filter().
It was discovered that a local attacker could pass a specially crafted configuration of conntrack to the kernel to cause a buffer overflow in ctnetlink_parse_tuple_filter() function. As a result, the kernel could crash.
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-25211
-
PSBM-107061
Potential kernel crash (use-after-free) in the implementation of usermode helpers.
A race condition was discovered in the implementation of usermode helpers in the kernel. An attacker could exploit it from a container to cause a denial-of-service (kernel crash due to a use-after-free), or, potentially, to escalate their privileges in the system.
-
PSBM-106408
nf_tables: kernel crash in nf_tables_getset().
It was discovered that the implementation of nf_tables did not properly validate certain parameters. An attacker could exploit this from a container to cause a kernel crash: NULL pointer dereference or a general protection fault in nf_tables_getset().
-
PSBM-106395
nfnetlink: potential kernel crash (skb_over_panic) in skb_put().
It was discovered that nfnetlink subsystem did not properly validate certain messages. An attacker could exploit this from a container to cause a kernel crash: skb_over_panic in skb_put().
-
PSBM-106273
nf_conntrack: potential kernel crash in nf_ct_gre_keymap_destroy().
https://bugs.openvz.org/browse/OVZ-7224
-
PSBM-105850
File system of a container becomes read-only, __ext4_handle_dirty_metadata() reports error 28.
https://forum.openvz.org/index.php?t=msg&th=13635
-
CVE-2020-0305
Possible use-after-free error due to a race condition in cdev_get().
It was discovered that use-after-free condition was possible in cdev_get() if multiple processes simultaneously accessed a character device in a certain way. A local attacker could potentially exploit this to crash the kernel.
https://access.redhat.com/security/cve/cve-2020-0305
-
PSBM-98148
memcg: kernel crash in memcg_destroy_kmem_caches() caused by unbalanced css_tryget/css_put operations.
-
CVE-2019-20812
af_packet: potential soft lockup in case of certain errors when using TPACKET_V3.
It was found that if TPACKET_V3 was used and the kernel failed to obtain certain settings from a relevant network device, the retirement timer could be set incorrectly in the implementation AF_PACKET protocol. This could result in soft lockups and excessive CPU usage.
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-20812
-
CVE-2020-10711
netlabel: kernel crash (null pointer dereference) while processing a specially crafted CIPSO packet.
A NULL pointer dereference was found in the implementation of SELinux. The issue occurs while importing the Commercial IP Security Option (CIPSO) protocol category bitmap into SELinux extensible bitmap. Parsing of a specially crafted CIPSO packet sent by a remote attacker could lead to a kernel crash (remote DoS).
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10711
-
CVE-2020-10732
Core dumps of some processes could contain uninitialized kernel data.
It was discovered that core dumps of userspace processes could contain copies of uninitialized kernel memory areas in certain cases. Although it is difficult for an attacker to control what data is in these areas, this issue, in theory, could be used to obtain sensitive information from the kernel.
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10732
-
CVE-2020-10769
crypto/authenc: kernel crash in crypto_ahash_setkey() when payload of a key is longer than 4 bytes and is not aligned.
An out-of-bounds read was found in the implementation of IPsec cryptographic algorithms ('authenc' module). When payload of a key was longer than 4 bytes but was not properly aligned, crypto_authenc_extractkeys() function could try to read data from a wrong location. This could lead to a kernel crash in crypto_ahash_setkey().
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10769
-
PSBM-104867
ploop: kernel crash (division by zero) in purge_lru_warn().
-
CVE-2020-12114
Denial of service by corrupting mountpoint reference counter.
It was discovered that a race condition was possible between pivot_root() and put_mountpoint() operations. A local unprivileged attacker could exploit this to corrupt mountpoint reference counter and cause a denial of service (kernel crash).
https://bugzilla.redhat.com/show_bug.cgi?id=1848652
-
PSBM-104563
ext4: potential kernel crash in ext4_cross_rename(): certain error cases were not checked properly.
-
PSBM-104517
ext4: use-after-free when unmounting a corrupted file system with files that have no links.
https://bugzilla.kernel.org/show_bug.cgi?id=205433
-
PSBM-104664
futex: potential system hang due to a missing unlock operation in the error path of futex_wait_requeue_pi().
-
PSBM-104530
cbt: potential endless loops in the error paths.
-
CVE-2020-14305
netfilter: potential memory corruption caused by a helper from nf_conntrack_h323 module.
https://bugs.openvz.org/browse/OVZ-7188
-
PSBM-104387
nf_conntrack: potential kernel crash in netlink_has_listeners().
-
PSBM-104342
ext4: attempts to freeze the FS could hang in certain cases due to an unbalanced internal write counter.
-
PSBM-104086
netlink: performance issues due to direct memory reclaim in netlink_dump() and netlink_trim().
-
PSBM-103975
memcg: kernel could crash when memory was uncharged from a cgroup while the cgroup was going offline.
It was found that a race was possible between uncharging memory from a cgroup and making that cgroup offline. This could lead to premature destruction of the cgroup and could cause a kernel crash.
-
PSBM-104125
packet: packet_sk_charge() could try to charge zero memory, leading to a use-after-free in memcg subsystem.
-
PSBM-103864
memcg: potential use-after-free in the implementation of uncharge operations.
-
PSBM-102320
qxl: kernel crash in qxl_release_fence_buffer_objects().
-
CVE-2020-10720
Use-after-free read in napi_gro_frags().
A flaw was found in the implementation of GRO, which allows an attacker with local access to trigger a use-after-free read in napi_gro_frags() and, potentially, crash the system.
https://bugzilla.redhat.com/show_bug.cgi?id=1781204
-
VSTOR-33397
i40iw: kernel complains about failed RTNL assertion in i40iw_addr_resolve_neigh().
-
PSBM-103518
Slow memory allocations in nf_conntrack when a netns is created.
When a new netns is created, high-order page allocations can happen in nf_ct_alloc_hashtable(). If memory is fragmented, such allocations can become very slow due to memory reclaim, etc. This, in turn, could result in significant slowdowns on the node.
-
PSBM-102407
nfsd: memory corruption in nfsd4_lock().
-
PSBM-102848
(enhancement) ploop: added interface to dump the cached BAT.
It was discovered that containers could get a broken on-disk BAT but have healthy in-kernel data in certain cases. To detect and fix such conditions, the means to dump the cached BAT were implemented in ploop. Note that, to make use of this enhancement, version 7.0.187.4 or newer of the userspace ploop tools is needed.
-
PSBM-102655
netfilter: kernel crash in the implementation of nf_tables due to use-after-free in dynamic operations.
-
PSBM-102363
A container with NFS server could force other such containers to use the older NFSv4 client tracker, which slows down NFS mounts.
-
VSTOR-32221
mpt2sas: scheduling while atomic in _scsih_io_done().
-
PSBM-101823
ploop: potential corruption of the index during discard operation.
A race condition was discovered in ploop, which could lead to corruption of the index during discard operations in certain cases. Note. It is not recommended to manually unload the ReadyKernel patch with the fix for this issue while any discard operations for ploop images are in progress: the ploop images could be corrupted as a result. Upgrading the patch is OK, only manual unloads and downgrades can be problematic.
-
PSBM-102070
ploop: warn if a discard request is issued for the ploop header.
-
PSBM-102033
ve: detect removal of additional system libraries in the containers to simplify debugging.
-
PSBM-101783
Potential leak of a reference counter for a memory cgroup in memcg_expand_shrinker_maps().
-
PSBM-101533
Potential corruption of ploop images due to a race between the truncation thread and resize operations.
-
PSBM-101595
ve: make it easier to analyze removal of system libraries in the containers.
-
CVE-2019-15538
xfs: potential denial of service caused by missing unlock operation in xfs_setattr_nonsize().
It was discovered that xfs_setattr_nonsize() would not unlock 'ILOCK' lock if the user or group were out of their disk quota. As a result, any subsequent operation, which needed to take 'ILOCK', would get stuck, leading to a denial of service.
https://access.redhat.com/security/cve/cve-2019-15538
-
PSBM-101492
nf_tables: kernel crash in nft_rbtree_lookup().
-
PSBM-101189
ploop: holes in raw ploop images were handled incorrectly.
-
PSBM-94695
Kernel crash due to out-of-bounds memory accesses in process_vm_readv().
It was discovered that the implementation of process_vm_readv() system call could try to access memory outside of the structures it was processing in certain cases. A local unprivileged user could use this vulnerability to crash the system.
-
PSBM-101159
quotaoff operation executed in a container could get stuck in D state.
-
PSBM-101143
Certain operations with an empty ploop image could lead to its unexpected growth.
-
PSBM-101249
Incomplete fix for PSBM-100575: reading of /proc/bc/resources line by line would never end.
-
PSBM-100509
memcg: memory corruption caused by writing beyond the end of shrinker_map structure.
-
PSBM-100722
ixgbe: lots of warnings in the system log due to incorrect check for firmware errors.
-
PSBM-100739
ploop: kernel crashes when processing discard requests for ploop images in raw format.
-
PSBM-100118
scsi: printing lots of messages about rejected I/O causes a hard lockup and a kernel crash.
-
PSBM-100593
Kernel crash in shrink_slab() when trying to mount an image with a broken ext4 file system.
-
PSBM-100575
Reading of /proc/bc/resources line by line would never end: no end of file was reported.
-
PSBM-100579
Potential kernel crash in __radix_tree_insert() when fscache is used for NFS mounts.
-
PSBM-99764
sunrpc: potential kernel crash in bc_svc_process().
-
PSBM-100441
A bug in ploop prevented recovery of corrupted ploop images.
-
VSTOR-29472
The minimum amount of reserved free memory (vm.min_free_kbytes) was set too high by default.
-
PSBM-96262
kvm: potential system hang due to an error in mmu_shrink_scan().
-
PSBM-96057
Processes could get stuck in copy_net_ns() forever.