readykernel-patch-163.46-143.0-1.vl7

Kernel Update Version:
3.10.0-1127.18.2.vz7.163.46
Release Date:
2022-06-29 09:59:02
  • CVE-2022-1966

    Use-after-free in the netfilter subsystem.

    The bug allows to initialize a non-stateful lookup expressions which points to a not properly detached set, which might lead to UAF. Potetntially it leads to privilege escalation.
    https://access.redhat.com/security/cve/CVE-2022-1966
  • PSBM-139465

    CPU hotplug leads to a VM crash on AMD processors with PCID.

  • CVE-2022-0492

    Potential privilege escalation when setting the release_agent.

    Setting release_agent could potentially lead to privilege escalation from unprivileged users inside a container to the container root. It couldn't be exploited to escape containers.
    https://access.redhat.com/security/cve/CVE-2022-0492
  • CVE-2021-0920

    Potential use-after-free in the 'recv' operation of UNIX domain sockets.

    Race condition between the garbage collector and the 'recv' operation with MSG_PEEK flag was found in the implementation of UNIX domain sockets. It could result in use-after-free and could potentially allow a local attacker to escalate their privileges in the system.
    https://access.redhat.com/security/cve/CVE-2021-0920
  • CVE-2021-4083

    Read-after-free in garbage collection for Unix domain socket file handlers.

  • CVE-2021-4028

    Use-after-free in RDMA listen().

  • PSBM-136140

    A flaw in XFS allows non-root users to read raw data from a mounted block device (CVE-2021-4155).

  • PSBM-136851

    Potential memory corruption in nfsd4_lock().

  • PSBM-136295

    fs/locks.c: Node crash BUG in locks_insert_block().

  • PSBM-136369

    fs: potential kernel crash in inode_permission() when processing paths containing '..'.

  • PSBM-134905

    nfsd: memory corruption and kernel crash in nfsd4_lock.

    It was discovered that certain operations with locks on NFS could result in a memory corruption and kernel crash in nfsd4_lock(). Note that, although the patch prevents new issues of this kind, it cannot fix the corruptions that have already occurred. So, kernel crashes are still possible even within a few hours after the ReadyKernel update has been applied, but should disappear after the reboot of the affected nodes.
  • PSBM-130907

    Kernel crash due to lack of enough skb headroom.

    It was found that the kernel could crash (skb_under_panic) when TEE target mirrors traffic to another interface. In this case skb may not have enough headroom to be processed correctly. It had been fixed for IPv4 but IPv6 continued to have the bug.
  • PSBM-134323

    Memory allocation failed unexpectedly in __add_to_page_cache_locked().

    Ext4 FS was unexpectedly remounted read-only in a container after the container reached the limits set in the memory cgroup. It happened because the relevant memory allocations failed in __add_to_page_cache_locked while __GFP_NOFAIL flag was dropped for certain reason.
  • PSBM-130508

    ext4: using RENAME_WHITEOUT flag when renaming files could cause file system errors ('deleted inode referenced').

  • CVE-2021-33909

    size_t-to-int conversion vulnerability in the filesystem layer.

    It was discovered that the implementation of seq_file files in the Linux kernel contained an error related to integer conversion (size_t to a signed integer). A local unprivileged attacker could use this to cause a denial of service (system crash) or execute arbitrary code.
    https://www.openwall.com/lists/oss-security/2021/07/20/1
  • PSBM-130317

    e2fsck considered the file system corrupted in certain situations because ext4 created initialized extents beyond the end of file.

  • PSBM-130509

    After certain operations with detached mounts, attempts to mount anything could unexpectedly fail with error 'No space left on device'.

  • PSBM-130693

    ceph: out-of-bounds accesses in dio_get_pagev_size() caused memory corruption.

  • PSBM-130575

    Network overlay 'weave' failed to create pairs of veth devices.

    It was discovered that 'weave' network overlay used with Kubernetes tried to create veth devices with MTU 65535 in certain cases. Such operations failed because the maximum allowed MTU was 1500.
  • PSBM-129500

    netfilter: potential kernel crash in nft_rbtree_deactivate().
  • PSBM-128205

    sch_teql: kernel crash in teql_destroy().

  • PSBM-129374

    ext4: timestamps could be updated in wrong inodes in certain cases, if the filesystem was mounted with 'lazytime' option.

  • PSBM-92950

    Memory leaks could happen when network-related structures were created for a starting container.
  • PSBM-128140

    netfilter: potential memory corruption in certain setsockopt() operations.

    It was discovered that an attacker could use a specially crafted sequence of system calls in a container to trigger a memory corruption in the implementation of setsockopt() in the netfilter subsystem. This could result in a kernel crash, or, potentially, could allow the attacker to escalate their privileges.
  • PSBM-127315

    'sit' tunnels could not be created in the containers even if 'sit:on' was set in the features.

  • VSTOR-42863

    Incorrect updates of page cache during certain operations with Virtuozzo Storage could lead to kernel crash.

  • PSBM-128405

    netfilter: potential memory corruption could happen when CLUSTERIP was used.

    It was discovered that an attacker could trigger kernel memory corruption from a container by using a specially crafted sequence of operations with CLUSTERIP-related netfilter rules.
  • PSBM-127478

    The kernel could crash in kmapset_hash() while stopping a container.

  • CVE-2021-27365

    Heap buffer overflow in the iSCSI subsystem.

    It was discovered that the kernel did not check the size of certain iSCSI-related data structures when presenting them in sysfs. A local unprivileged attacker could exploit this (by sending a specially crafted netlink message) to cause a denial of service (system crash) or possibly execute arbitrary code.
    https://bugzilla.redhat.com/show_bug.cgi?id=1930078
  • CVE-2021-27363

    Unrestricted access to sessions and handles in the iSCSI subsystem.

    It was discovered that the kernel did not properly restrict access to iSCSI sessions and transport handles. A local unprivileged attacker could use this to end arbitrary iSCSI sessions (potentially causing a denial of service) or to expose locations of certain kernel structures.
    https://bugzilla.redhat.com/show_bug.cgi?id=1930079
  • CVE-2021-27364

    Out-of-bounds read in the iSCSI subsystem.

    It was discovered that a local unprivileged attacker could use specially crafted netlink messages to trigger an out-of-bounds read in 'scsi_transport_iscsi' module. The kernel could crash as a result.
    https://bugzilla.redhat.com/show_bug.cgi?id=1930080
  • PSBM-122965

    ip_set: null pointer dereference in ip_set_utest().

    It was discovered that an attacker could trigger a kernel crash (null pointer dereference) in ip_set_utest() by running a specially crafted sequence of system calls in a container.
  • PSBM-123063

    ip_set: kernel crash in ip_set_comment_free().

    It was discovered that an attacker could trigger a kernel crash (general protection fault) in ip_set_comment_free() by running a specially crafted sequence of system calls in a container.
  • PSBM-123084

    xfrm subsystem of the Linux kernel could accept user-defined templates with invalid protocol numbers, which caused warnings in xfrm_state_fini().

  • CVE-2021-3178

    If a subdirectory of a file system was exported via NFS, an attacker could use READDIRPLUS operation to access other parts of that file system.

    https://access.redhat.com/security/cve/cve-2021-3178
  • PSBM-124496

    pcompact would not compact ploop files if the underlying disk partitions had unusual alignment.

  • PSBM-126136

    Virtual machines could not start in certain cases due to incorrect detection of CPU feature 'IBPB'.

  • PSBM-126014

    The number of memory cgroups reached its limit because such cgroups were not deleted in certain cases.

    It was discovered that memory cgroups were not deleted in certain cases. Over time, the limit on the number of memory cgroups could be hit and new cgroups would not be created. As a result, containers could fail to start and would report 'Cannot allocate memory' errors, docker could fail to run in the containers too, etc.
  • PSBM-122990

    'Bad unlock balance' error in ipmr_mfc_seq_stop().

    It was discovered that the implementation of IPv6 multicast routing could try to access wrong data when a user tried to read certain files in /proc. An attacker could exploit that from a container to trigger 'bad unlock balance' error in ipmr_mfc_seq_stop(), followed by a kernel crash.
  • PSBM-122991

    Soft lockup in ext4_ext_find_extent().

    It was discovered that certain ioctl operations in ext4 did not check their arguments properly. An attacker could exploit that from a container to trigger soft lockups in ext4_ext_find_extent() function, which could result in a denial of service.
  • CVE-2020-29661

    Incorrect locking in TTY subsystem could lead to use-after-free conditions and cause memory corruption.

    https://access.redhat.com/security/cve/cve-2020-29661
  • PSBM-124581

    Userspace processes could crash with 'double free or corruption' errors due to a lost TLB flush in the kernel.

  • VSTOR-39656

    fuse_kio_pcs: Potential kernel crash in fuse_map_resolve().

  • PSBM-123043

    A specially crafted program running in a container could make certain processes on the host hang (denial of service).

  • PSBM-123085

    Kernel crash due to an incorrect BUG_ON() assertion in move_freepages().