-
CVE-2017-17807
Missing permissions check for request_key() destination allows local attackers to add keys to keyring without write permission.
The KEYS subsystem omitted an access-control check when writing a key to the default keyring of the current task, allowing a local user to bypass security checks for the keyring. This compromised the validity of the keyring for those who relied on it.
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-17807
-
CVE-2017-17450
System-wide OS fingerprint list was accessible to unprivileged users.
It was discovered that xt_osf_fingers data structure was accessible from any network namespace. This allowed unprivileged local users to bypass intended access restrictions and modify the system-wide OS fingerprint list used by specific iptables rules.
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-17450
-
CVE-2017-17449
Netlink monitor created in a namespace could observe system-wide activity.
It was discovered that a nlmon link inside a child network namespace was not restricted to that namespace. An unprivilged local user could exploit that to monitor system-wide netlink activity.
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-17449
-
CVE-2017-17448
Potential unprivileged access to the kernel structures used by netfilter conntrack helpers.
It was discovered that nfnl_cthelper_list structure was accessible to any user with CAP_NET_ADMIN capability in a network namespace. An unprivilged local user could exploit that to affect netfilter conntrack helpers on the host.
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-17448
-
PSBM-83691
Kernel crash in shrink_slab() when trying to mount an image with a broken ext4 file system.
-
PSBM-83628
Offlined memory cgroups were not destroyed for a long time.
It was found that offlined memory cgroups were not destroyed for a long time in some cases. As a result, the system could hit the limit on cgroups (65535) and would be unable to create new ones.
-
PSBM-83746
Kernel crash in move_freepages() due to incorrect BUG_ON() check.
It was discovered that the BUG_ON() check in move_freepages() did not verify that the relevant memory pages were valid. The kernel could crash as a result.
-
PSBM-83874
Kernel crash (stack overflow) caused by lots of internal mounts.
It was discovered that clone_mnt() did not clear MNT_INTERNAL flag for the internal mounts. As a result, the kernel could crash due to a stack overflow if lots of bind mounts of /proc/*/ns/* were created in a new namespace.
https://www.spinics.net/lists/netdev/msg496514.html
-
PSBM-83474
Kernel crash in ip6mr_sk_done().
If the kernel failed to create an IPv6 socket, for example, due to cgroup.memsw limit, it would crash in ip6mr_sk_done() when trying to clean up multicast routes.
-
PSBM-79229
Live migration of containers failed: it could not create tun device.
If a container used its own network namespace for tun devices, suspend/resume and live migration of the container would fail with errors like "Can't create tun device".
-
PSBM-81798
IPv6 routing tables incorrectly handled routing rules for throw routes.
It was discovered that IPv6 routing tables incorrectly handled routing rules for throw routes. This happened because errors were not propagated properly up to the fib_rules_lookup().
-
PSBM-82766
Container remained mounted in some cases after 'shutdown -h now' in it.
It was discovered that incorrect state of a container could be reported in /sys/fs/cgroup/ve/CTID/ve.state in some cases, which confused the user-space tools. As a result, a container could remain mounted after 'shutdown -h now' in it.
-
PSBM-82984
Potential kernel crash in fs/file.c: out-of-bounds access to the file descriptor table.
-
CVE-2018-1068
ebtables: out-of-bounds write via userland offsets in ebt_entry struct.
It was discovered that the implementation of ebtables in the kernel did not properly validate the offsets received from the user space. A local user with enough privileges in the user and network namespaces could use that to trigger an out-of-bounds write to the kernel address space.
https://bugzilla.redhat.com/show_bug.cgi?id=1552048
-
PSBM-81940
tcache invalidation was broken.
The fix for a race in tcache inadvertently broke tcache invalidation, leading to kernel warnings in tcache_invalidate_node_pages() among other things.
-
PSBM-81939
Potential kernel hang (endless loop) in try_charge().
-
PSBM-83692
Kernel crash in dccp_write_xmit().