-
CVE-2020-25212
NFS v4: potential memory corruption on the client system when processing security attributes.
It was discovered that a buffer overflow and memory corruption were possible if a system tried to mount an NFS v4 share where the files had security labels in the file attributes. An attacker would need to control the NFS server and make it send a specific series of responses to trigger the issue. The issue allows the attacker to crash the kernel on the client system or, potentially, escalate their privileges there.
https://access.redhat.com/security/cve/CVE-2020-25212
-
CVE-2020-25211
netfilter: kernel crash due to a buffer overflow in ctnetlink_parse_tuple_filter().
It was discovered that a local attacker could pass a specially crafted configuration of conntrack to the kernel to cause a buffer overflow in ctnetlink_parse_tuple_filter() function. As a result, the kernel could crash.
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-25211
-
CVE-2020-14385
The metadata validator in XFS may flag an inode with a valid extended attribute as corrupt.
A failure of the file system metadata validator in XFS can cause an inode with a valid, user-creatable extended attribute to be flagged as corrupt. This can lead to the filesystem being shutdown, or otherwise rendered inaccessible until it is remounted, leading to a denial of service.
https://access.redhat.com/security/cve/cve-2020-14385
-
PSBM-107061
Potential kernel crash (use-after-free) in the implementation of usermode helpers.
A race condition was discovered in the implementation of usermode helpers in the kernel. An attacker could exploit it from a container to cause a denial-of-service (kernel crash due to a use-after-free), or, potentially, to escalate their privileges in the system.
-
PSBM-106408
nf_tables: kernel crash in nf_tables_getset().
It was discovered that the implementation of nf_tables did not properly validate certain parameters. An attacker could exploit this from a container to cause a kernel crash: NULL pointer dereference or a general protection fault in nf_tables_getset().
-
PSBM-106395
nfnetlink: potential kernel crash (skb_over_panic) in skb_put().
It was discovered that nfnetlink subsystem did not properly validate certain messages. An attacker could exploit this from a container to cause a kernel crash: skb_over_panic in skb_put().
-
PSBM-99181
Memory reclaim could become too slow leading to high LA on the nodes.
The original fix for PSBM-99181 and related issues introduced a problem: management of shrinkers used to reclaim memory could become very inefficient in certain cases, causing higher load on the affected nodes.
-
PSBM-106273
nf_conntrack: potential kernel crash in nf_ct_gre_keymap_destroy().
https://bugs.openvz.org/browse/OVZ-7224
-
PSBM-106384
memcg: the limit on page cache (memory.cache.limit_in_bytes) could be exceeded significantly in certain cases.
-
PSBM-105850
File system of a container becomes read-only, __ext4_handle_dirty_metadata() reports error 28.
https://forum.openvz.org/index.php?t=msg&th=13635
-
CVE-2020-0305
Possible use-after-free error due to a race condition in cdev_get().
It was discovered that use-after-free condition was possible in cdev_get() if multiple processes simultaneously accessed a character device in a certain way. A local attacker could potentially exploit this to crash the kernel.
https://access.redhat.com/security/cve/cve-2020-0305
-
PSBM-98148
memcg: kernel crash in memcg_destroy_kmem_caches() caused by unbalanced css_tryget/css_put operations.
-
PSBM-105237
Hard lockup and kernel crash caused by incorrect locking in calc_load_ve().
-
CVE-2019-20812
af_packet: potential soft lockup in case of certain errors when using TPACKET_V3.
It was found that if TPACKET_V3 was used and the kernel failed to obtain certain settings from a relevant network device, the retirement timer could be set incorrectly in the implementation AF_PACKET protocol. This could result in soft lockups and excessive CPU usage.
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-20812
-
CVE-2020-10732
Core dumps of some processes could contain uninitialized kernel data.
It was discovered that core dumps of userspace processes could contain copies of uninitialized kernel memory areas in certain cases. Although it is difficult for an attacker to control what data is in these areas, this issue, in theory, could be used to obtain sensitive information from the kernel.
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10732
-
PSBM-104867
ploop: kernel crash (division by zero) in purge_lru_warn().
-
CVE-2020-12114
Denial of service by corrupting mountpoint reference counter.
It was discovered that a race condition was possible between pivot_root() and put_mountpoint() operations. A local unprivileged attacker could exploit this to corrupt mountpoint reference counter and cause a denial of service (kernel crash).
https://bugzilla.redhat.com/show_bug.cgi?id=1848652
-
PSBM-104664
futex: potential system hang due to a missing unlock operation in the error path of futex_wait_requeue_pi().