Memory leaks could happen when network-related structures were created for a starting container.
netfilter: potential memory corruption in certain setsockopt() operations.
It was discovered that an attacker could use a specially crafted sequence of system calls in a container to trigger a memory corruption in the implementation of setsockopt() in the netfilter subsystem. This could result in a kernel crash, or, potentially, could allow the attacker to escalate their privileges.
'sit' tunnels could not be created in the containers even if 'sit:on' was set in the features.
Incorrect updates of page cache during certain operations with Virtuozzo Storage could lead to kernel crash.
netfilter: potential memory corruption could happen when CLUSTERIP was used.
It was discovered that an attacker could trigger kernel memory corruption from a container by using a specially crafted sequence of operations with CLUSTERIP-related netfilter rules.
The kernel could crash in kmapset_hash() while stopping a container.
Heap buffer overflow in the iSCSI subsystem.
It was discovered that the kernel did not check the size of certain iSCSI-related data structures when presenting them in sysfs. A local unprivileged attacker could exploit this (by sending a specially crafted netlink message) to cause a denial of service (system crash) or possibly execute arbitrary code.
Unrestricted access to sessions and handles in the iSCSI subsystem.
It was discovered that the kernel did not properly restrict access to iSCSI sessions and transport handles. A local unprivileged attacker could use this to end arbitrary iSCSI sessions (potentially causing a denial of service) or to expose locations of certain kernel structures.
Out-of-bounds read in the iSCSI subsystem.
It was discovered that a local unprivileged attacker could use specially crafted netlink messages to trigger an out-of-bounds read in 'scsi_transport_iscsi' module. The kernel could crash as a result.
ip_set: null pointer dereference in ip_set_utest().
It was discovered that an attacker could trigger a kernel crash (null pointer dereference) in ip_set_utest() by running a specially crafted sequence of system calls in a container.
ip_set: kernel crash in ip_set_comment_free().
It was discovered that an attacker could trigger a kernel crash (general protection fault) in ip_set_comment_free() by running a specially crafted sequence of system calls in a container.
xfrm subsystem of the Linux kernel could accept user-defined templates with invalid protocol numbers, which caused warnings in xfrm_state_fini().
If a subdirectory of a file system was exported via NFS, an attacker could use READDIRPLUS operation to access other parts of that file system.
pcompact would not compact ploop files if the underlying disk partitions had unusual alignment.
Virtual machines could not start in certain cases due to incorrect detection of CPU feature 'IBPB'.
The number of memory cgroups reached its limit because such cgroups were not deleted in certain cases.
It was discovered that memory cgroups were not deleted in certain cases. Over time, the limit on the number of memory cgroups could be hit and new cgroups would not be created. As a result, containers could fail to start and would report 'Cannot allocate memory' errors, docker could fail to run in the containers too, etc.
'Bad unlock balance' error in ipmr_mfc_seq_stop().
It was discovered that the implementation of IPv6 multicast routing could try to access wrong data when a user tried to read certain files in /proc. An attacker could exploit that from a container to trigger 'bad unlock balance' error in ipmr_mfc_seq_stop(), followed by a kernel crash.
Soft lockup in ext4_ext_find_extent().
It was discovered that certain ioctl operations in ext4 did not check their arguments properly. An attacker could exploit that from a container to trigger soft lockups in ext4_ext_find_extent() function, which could result in a denial of service.
Incorrect locking in TTY subsystem could lead to use-after-free conditions and cause memory corruption.
Userspace processes could crash with 'double free or corruption' errors due to a lost TLB flush in the kernel.
fuse_kio_pcs: Potential kernel crash in fuse_map_resolve().
A specially crafted program running in a container could make certain processes on the host hang (denial of service).
Kernel crash due to an incorrect BUG_ON() assertion in move_freepages().