-
CVE-2021-0920
Potential use-after-free in the 'recv' operation of UNIX domain sockets.
Race condition between the garbage collector and the 'recv' operation with MSG_PEEK flag was found in the implementation of UNIX domain sockets. It could result in use-after-free and could potentially allow a local attacker to escalate their privileges in the system.
https://access.redhat.com/security/cve/CVE-2021-0920
-
PSBM-136140
A flaw in XFS allows non-root users to read raw data from a mounted block device (CVE-2021-4155).
-
PSBM-136851
Potential memory corruption in nfsd4_lock().
-
PSBM-136295
fs/locks.c: Node crash BUG in locks_insert_block().
-
PSBM-136369
fs: potential kernel crash in inode_permission() when processing paths containing '..'.
-
PSBM-134905
nfsd: memory corruption and kernel crash in nfsd4_lock.
It was discovered that certain operations with locks on NFS could result in a memory corruption and kernel crash in nfsd4_lock(). Note that, although the patch prevents new issues of this kind, it cannot fix the corruptions that have already occurred. So, kernel crashes are still possible even within a few hours after the ReadyKernel update has been applied, but should disappear after the reboot of the affected nodes.
-
PSBM-130907
Kernel crash due to lack of enough skb headroom.
It was found that the kernel could crash (skb_under_panic) when TEE target mirrors traffic to another interface. In this case skb may not have enough headroom to be processed correctly. It had been fixed for IPv4 but IPv6 continued to have the bug.
-
PSBM-134323
Memory allocation failed unexpectedly in __add_to_page_cache_locked().
Ext4 FS was unexpectedly remounted read-only in a container after the container reached the limits set in the memory cgroup. It happened because the relevant memory allocations failed in __add_to_page_cache_locked while __GFP_NOFAIL flag was dropped for certain reason.
-
PSBM-130508
ext4: using RENAME_WHITEOUT flag when renaming files could cause file system errors ('deleted inode referenced').
-
CVE-2021-33909
size_t-to-int conversion vulnerability in the filesystem layer.
It was discovered that the implementation of seq_file files in the Linux kernel contained an error related to integer conversion (size_t to a signed integer). A local unprivileged attacker could use this to cause a denial of service (system crash) or execute arbitrary code.
https://www.openwall.com/lists/oss-security/2021/07/20/1
-
PSBM-130317
e2fsck considered the file system corrupted in certain situations because ext4 created initialized extents beyond the end of file.
-
PSBM-130693
ceph: out-of-bounds accesses in dio_get_pagev_size() caused memory corruption.
-
PSBM-130575
Network overlay 'weave' failed to create pairs of veth devices.
It was discovered that 'weave' network overlay used with Kubernetes tried to create veth devices with MTU 65535 in certain cases. Such operations failed because the maximum allowed MTU was 1500.
-
PSBM-128205
sch_teql: kernel crash in teql_destroy().
-
PSBM-129374
ext4: timestamps could be updated in wrong inodes in certain cases, if the filesystem was mounted with 'lazytime' option.
-
PSBM-92950
Memory leaks could happen when network-related structures were created for a starting container.
-
PSBM-128140
netfilter: potential memory corruption in certain setsockopt() operations.
It was discovered that an attacker could use a specially crafted sequence of system calls in a container to trigger a memory corruption in the implementation of setsockopt() in the netfilter subsystem. This could result in a kernel crash, or, potentially, could allow the attacker to escalate their privileges.
-
VSTOR-42863
Incorrect updates of page cache during certain operations with Virtuozzo Storage could lead to kernel crash.
-
PSBM-128405
netfilter: potential memory corruption could happen when CLUSTERIP was used.
It was discovered that an attacker could trigger kernel memory corruption from a container by using a specially crafted sequence of operations with CLUSTERIP-related netfilter rules.
-
PSBM-127478
The kernel could crash in kmapset_hash() while stopping a container.
-
CVE-2021-27365
Heap buffer overflow in the iSCSI subsystem.
It was discovered that the kernel did not check the size of certain iSCSI-related data structures when presenting them in sysfs. A local unprivileged attacker could exploit this (by sending a specially crafted netlink message) to cause a denial of service (system crash) or possibly execute arbitrary code.
https://bugzilla.redhat.com/show_bug.cgi?id=1930078
-
CVE-2021-27363
Unrestricted access to sessions and handles in the iSCSI subsystem.
It was discovered that the kernel did not properly restrict access to iSCSI sessions and transport handles. A local unprivileged attacker could use this to end arbitrary iSCSI sessions (potentially causing a denial of service) or to expose locations of certain kernel structures.
https://bugzilla.redhat.com/show_bug.cgi?id=1930079
-
CVE-2021-27364
Out-of-bounds read in the iSCSI subsystem.
It was discovered that a local unprivileged attacker could use specially crafted netlink messages to trigger an out-of-bounds read in 'scsi_transport_iscsi' module. The kernel could crash as a result.
https://bugzilla.redhat.com/show_bug.cgi?id=1930080
-
PSBM-122965
ip_set: null pointer dereference in ip_set_utest().
It was discovered that an attacker could trigger a kernel crash (null pointer dereference) in ip_set_utest() by running a specially crafted sequence of system calls in a container.
-
PSBM-123063
ip_set: kernel crash in ip_set_comment_free().
It was discovered that an attacker could trigger a kernel crash (general protection fault) in ip_set_comment_free() by running a specially crafted sequence of system calls in a container.
-
PSBM-123084
xfrm subsystem of the Linux kernel could accept user-defined templates with invalid protocol numbers, which caused warnings in xfrm_state_fini().
-
CVE-2021-3178
If a subdirectory of a file system was exported via NFS, an attacker could use READDIRPLUS operation to access other parts of that file system.
https://access.redhat.com/security/cve/cve-2021-3178
-
PSBM-126136
Virtual machines could not start in certain cases due to incorrect detection of CPU feature 'IBPB'.
-
PSBM-122990
'Bad unlock balance' error in ipmr_mfc_seq_stop().
It was discovered that the implementation of IPv6 multicast routing could try to access wrong data when a user tried to read certain files in /proc. An attacker could exploit that from a container to trigger 'bad unlock balance' error in ipmr_mfc_seq_stop(), followed by a kernel crash.
-
PSBM-122991
Soft lockup in ext4_ext_find_extent().
It was discovered that certain ioctl operations in ext4 did not check their arguments properly. An attacker could exploit that from a container to trigger soft lockups in ext4_ext_find_extent() function, which could result in a denial of service.
-
CVE-2020-29661
Incorrect locking in TTY subsystem could lead to use-after-free conditions and cause memory corruption.
https://access.redhat.com/security/cve/cve-2020-29661
-
PSBM-123043
A specially crafted program running in a container could make certain processes on the host hang (denial of service).
-
PSBM-122653
Kernel crash in mem_cgroup_from_cont() due to a race between memory reclaim and offlining of a cgroup.
-
PSBM-123085
Kernel crash due to an incorrect BUG_ON() assertion in move_freepages().
-
PSBM-122035
ploop: certain operations with large ploop images could lead to a division by zero in __map_extent_bmap().
-
PSBM-121833
nfsd: Potential kernel crash in nfs4_put_stid().
-
PSBM-121772
'ploop grow' operation could fail in certain cases if the ploop image file contained holes.
-
PSBM-121523
Processes being killed by the OOM killer could continue consuming memory.
If a process running in a container performed large allocations of kernel memory, this could hit the memory limit for the container and trigger the OOM killer. It was discovered, however, that the process being killed by it could continue consuming memory for some time. This could lead to out of memory conditions on the host.
-
PSBM-121135
'ploop snapshot' operation could hang in certain cases.
-
PSBM-106785
bcache: Potential kernel crash when using RAID1 as a backing device.
-
PSBM-108276
ploop: Potential kernel crash or data corruption during backups due to racy operations with lockout data.
-
PSBM-108091
netfilter/ipset: excessive memory consumption leading to a denial of service.
If was discovered that not all memory allocated for ipset-related data was properly accounted for. An attacker could exploit it from a container to consume lots of kernel memory, making the host system unusable (denial of service).
-
CVE-2020-25212
NFS v4: potential memory corruption on the client system when processing security attributes.
It was discovered that a buffer overflow and memory corruption were possible if a system tried to mount an NFS v4 share where the files had security labels in the file attributes. An attacker would need to control the NFS server and make it send a specific series of responses to trigger the issue. The issue allows the attacker to crash the kernel on the client system or, potentially, escalate their privileges there.
https://access.redhat.com/security/cve/CVE-2020-25212
-
CVE-2020-25211
netfilter: kernel crash due to a buffer overflow in ctnetlink_parse_tuple_filter().
It was discovered that a local attacker could pass a specially crafted configuration of conntrack to the kernel to cause a buffer overflow in ctnetlink_parse_tuple_filter() function. As a result, the kernel could crash.
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-25211
-
CVE-2020-14385
The metadata validator in XFS may flag an inode with a valid extended attribute as corrupt.
A failure of the file system metadata validator in XFS can cause an inode with a valid, user-creatable extended attribute to be flagged as corrupt. This can lead to the filesystem being shutdown, or otherwise rendered inaccessible until it is remounted, leading to a denial of service.
https://access.redhat.com/security/cve/cve-2020-14385
-
PSBM-107061
Potential kernel crash (use-after-free) in the implementation of usermode helpers.
A race condition was discovered in the implementation of usermode helpers in the kernel. An attacker could exploit it from a container to cause a denial-of-service (kernel crash due to a use-after-free), or, potentially, to escalate their privileges in the system.
-
PSBM-106408
nf_tables: kernel crash in nf_tables_getset().
It was discovered that the implementation of nf_tables did not properly validate certain parameters. An attacker could exploit this from a container to cause a kernel crash: NULL pointer dereference or a general protection fault in nf_tables_getset().
-
PSBM-106395
nfnetlink: potential kernel crash (skb_over_panic) in skb_put().
It was discovered that nfnetlink subsystem did not properly validate certain messages. An attacker could exploit this from a container to cause a kernel crash: skb_over_panic in skb_put().
-
PSBM-99181
Memory reclaim could become too slow leading to high LA on the nodes.
The original fix for PSBM-99181 and related issues introduced a problem: management of shrinkers used to reclaim memory could become very inefficient in certain cases, causing higher load on the affected nodes.
-
PSBM-106273
nf_conntrack: potential kernel crash in nf_ct_gre_keymap_destroy().
https://bugs.openvz.org/browse/OVZ-7224
-
PSBM-106384
memcg: the limit on page cache (memory.cache.limit_in_bytes) could be exceeded significantly in certain cases.
-
PSBM-105850
File system of a container becomes read-only, __ext4_handle_dirty_metadata() reports error 28.
https://forum.openvz.org/index.php?t=msg&th=13635
-
CVE-2020-0305
Possible use-after-free error due to a race condition in cdev_get().
It was discovered that use-after-free condition was possible in cdev_get() if multiple processes simultaneously accessed a character device in a certain way. A local attacker could potentially exploit this to crash the kernel.
https://access.redhat.com/security/cve/cve-2020-0305
-
PSBM-98148
memcg: kernel crash in memcg_destroy_kmem_caches() caused by unbalanced css_tryget/css_put operations.
-
PSBM-105237
Hard lockup and kernel crash caused by incorrect locking in calc_load_ve().
-
CVE-2019-20812
af_packet: potential soft lockup in case of certain errors when using TPACKET_V3.
It was found that if TPACKET_V3 was used and the kernel failed to obtain certain settings from a relevant network device, the retirement timer could be set incorrectly in the implementation AF_PACKET protocol. This could result in soft lockups and excessive CPU usage.
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-20812
-
CVE-2020-10732
Core dumps of some processes could contain uninitialized kernel data.
It was discovered that core dumps of userspace processes could contain copies of uninitialized kernel memory areas in certain cases. Although it is difficult for an attacker to control what data is in these areas, this issue, in theory, could be used to obtain sensitive information from the kernel.
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10732
-
PSBM-104867
ploop: kernel crash (division by zero) in purge_lru_warn().
-
CVE-2020-12114
Denial of service by corrupting mountpoint reference counter.
It was discovered that a race condition was possible between pivot_root() and put_mountpoint() operations. A local unprivileged attacker could exploit this to corrupt mountpoint reference counter and cause a denial of service (kernel crash).
https://bugzilla.redhat.com/show_bug.cgi?id=1848652
-
PSBM-104664
futex: potential system hang due to a missing unlock operation in the error path of futex_wait_requeue_pi().