readykernel-patch-158.8-124.0-1.vl7

Kernel Update Version:
3.10.0-1127.8.2.vz7.158.8
Release Date:
2021-03-12 07:39:01
  • PSBM-122965

    ip_set: null pointer dereference in ip_set_utest().

    It was discovered that an attacker could trigger a kernel crash (null pointer dereference) in ip_set_utest() by running a specially crafted sequence of system calls in a container.
  • PSBM-123063

    ip_set: kernel crash in ip_set_comment_free().

    It was discovered that an attacker could trigger a kernel crash (general protection fault) in ip_set_comment_free() by running a specially crafted sequence of system calls in a container.
  • PSBM-123084

    xfrm subsystem of the Linux kernel could accept user-defined templates with invalid protocol numbers, which caused warnings in xfrm_state_fini().

  • CVE-2021-20265

    Memory leak in the implementation of unix sockets.

    It was discovered that the implementation of unix sockets did not free certain data structures if a signal was received while unix_stream_recvmsg() function was running. An unprivileged local attacker could exploit this memory leak to cause a denial of service.
    https://access.redhat.com/security/cve/cve-2021-20265
  • CVE-2021-3178

    If a subdirectory of a file system was exported via NFS, an attacker could use READDIRPLUS operation to access other parts of that file system.

    https://access.redhat.com/security/cve/cve-2021-3178
  • PSBM-126136

    Virtual machines could not start in certain cases due to incorrect detection of CPU feature 'IBPB'.

  • PSBM-122990

    'Bad unlock balance' error in ipmr_mfc_seq_stop().

    It was discovered that the implementation of IPv6 multicast routing could try to access wrong data when a user tried to read certain files in /proc. An attacker could exploit that from a container to trigger 'bad unlock balance' error in ipmr_mfc_seq_stop(), followed by a kernel crash.
  • PSBM-122991

    Soft lockup in ext4_ext_find_extent().

    It was discovered that certain ioctl operations in ext4 did not check their arguments properly. An attacker could exploit that from a container to trigger soft lockups in ext4_ext_find_extent() function, which could result in a denial of service.
  • CVE-2020-29661

    Incorrect locking in TTY subsystem could lead to use-after-free conditions and cause memory corruption.

    https://access.redhat.com/security/cve/cve-2020-29661
  • PSBM-123043

    A specially crafted program running in a container could make certain processes on the host hang (denial of service).

  • PSBM-122653

    Kernel crash in mem_cgroup_from_cont() due to a race between memory reclaim and offlining of a cgroup.

  • PSBM-123085

    Kernel crash due to an incorrect BUG_ON() assertion in move_freepages().

  • PSBM-122035

    ploop: certain operations with large ploop images could lead to a division by zero in __map_extent_bmap().

  • PSBM-121833

    nfsd: Potential kernel crash in nfs4_put_stid().

  • PSBM-121772

    'ploop grow' operation could fail in certain cases if the ploop image file contained holes.

  • PSBM-121523

    Processes being killed by the OOM killer could continue consuming memory.

    If a process running in a container performed large allocations of kernel memory, this could hit the memory limit for the container and trigger the OOM killer. It was discovered, however, that the process being killed by it could continue consuming memory for some time. This could lead to out of memory conditions on the host.
  • PSBM-121135

    'ploop snapshot' operation could hang in certain cases.

  • PSBM-106785

    bcache: Potential kernel crash when using RAID1 as a backing device.

  • PSBM-108276

    ploop: Potential kernel crash or data corruption during backups due to racy operations with lockout data.

  • PSBM-108091

    netfilter/ipset: excessive memory consumption leading to a denial of service.

    If was discovered that not all memory allocated for ipset-related data was properly accounted for. An attacker could exploit it from a container to consume lots of kernel memory, making the host system unusable (denial of service).
  • CVE-2020-25212

    NFS v4: potential memory corruption on the client system when processing security attributes.

    It was discovered that a buffer overflow and memory corruption were possible if a system tried to mount an NFS v4 share where the files had security labels in the file attributes. An attacker would need to control the NFS server and make it send a specific series of responses to trigger the issue. The issue allows the attacker to crash the kernel on the client system or, potentially, escalate their privileges there.
    https://access.redhat.com/security/cve/CVE-2020-25212
  • CVE-2020-25211

    netfilter: kernel crash due to a buffer overflow in ctnetlink_parse_tuple_filter().

    It was discovered that a local attacker could pass a specially crafted configuration of conntrack to the kernel to cause a buffer overflow in ctnetlink_parse_tuple_filter() function. As a result, the kernel could crash.
    https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-25211
  • CVE-2020-14385

    The metadata validator in XFS may flag an inode with a valid extended attribute as corrupt.

    A failure of the file system metadata validator in XFS can cause an inode with a valid, user-creatable extended attribute to be flagged as corrupt. This can lead to the filesystem being shutdown, or otherwise rendered inaccessible until it is remounted, leading to a denial of service.
    https://access.redhat.com/security/cve/cve-2020-14385