-
PSBM-94695
Kernel crash due to out-of-bounds memory accesses in process_vm_readv().
It was discovered that the implementation of process_vm_readv() system call could try to access memory outside of the structures it was processing in certain cases. A local unprivileged user could use this vulnerability to crash the system.
-
PSBM-101143
Certain operations with an empty ploop image could lead to its unexpected growth.
-
PSBM-100509
memcg: memory corruption caused by writing beyond the end of shrinker_map structure.
-
PSBM-100739
ploop: kernel crashes when processing discard requests for ploop images in raw format.
-
PSBM-100118
scsi: printing lots of messages about rejected I/O causes a hard lockup and a kernel crash.
-
PSBM-100579
Potential kernel crash in __radix_tree_insert() when fscache is used for NFS mounts.
-
PSBM-99764
sunrpc: potential kernel crash in bc_svc_process().
-
PSBM-100441
A bug in ploop prevented recovery of corrupted ploop images.
-
PSBM-99557
Kernel crash in the implementation of epoll_ctl system call.
-
PSBM-99561
Kernel crash in __generic_splice_read().
-
CVE-2019-14821
KVM: Out-of-bounds memory access via MMIO ring buffer.
An issue was found in the implementation of the coalesced MMIO write operation in KVM. The indices used to access an MMIO ring buffer could be supplied by a user-space process in the host system. An attacker with access to /dev/kvm could use this flaw to trigger out-of-bounds memory access and crash the host kernel or, potentially, escalate their privileges.
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14821
-
CVE-2019-15239
Potential kernel crash in __tcp_retransmit_skb().
It was discovered that a local unprivileged attacker could use a specially crafted sequence of system calls to trigger either a kernel crash in __tcp_retransmit_skb() or use-after-free conditions, which could result in privilege escalation.
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-15239
-
PSBM-98522
Certain operations with iptables in a container may crash the kernel.
-
PSBM-98297
A container that tries to mount NFS shares may cause the whole system to hang in certain conditions.
-
CVE-2018-7191
tun: potential kernel crash when TUNSETIFF ioctl operation is used for a device with an invalid name.
https://bugzilla.redhat.com/show_bug.cgi?id=1716328
-
CVE-2018-20856
Use-after-free in __blk_drain_queue() function.
It was found that a use-after-free condition could be triggered in the block device subsystem while the outstanding command queue was drained. A patient local attacker can use this flaw to crash the system or, potentially, to escalate their privileges.
https://bugzilla.redhat.com/show_bug.cgi?id=1738705
-
PSBM-97738
sunrpc: kernel crash in svcauth_unix_set_client().
-
PSBM-98313
Base ploop images containing holes could become larger than needed after merge.
-
PSBM-96719
Data corruption in the EXT4 file system when truncating the extent index blocks.
-
PSBM-95177
Kernel complained about busy inodes after unmount of NFS shares and crashed in certain cases.
-
PSBM-97012
memcg: race condition between reparenting and kmem uncharging.
It was discovered that a race condition was possible between kmem uncharging and mem_cgroup_reparent_charges(). A kernel warning would be triggered as a result.
-
PSBM-97905
Kernel crashed in down_read() when a FUSE file system was exported via NFS.
-
CVE-2019-14835
vhost-net: guest to host kernel escape during migration
A buffer overflow vulnerability was found in the networking virtualization functionality (vhost-net) that could be abused during live migration of virtual machines. A privileged guest user may pass descriptors with invalid length to the host when live migration is underway to crash the host kernel or, potentially, escalate their privileges on the host.
https://bugzilla.redhat.com/show_bug.cgi?id=1750727
-
PSBM-97319
Ploop image could grow over its limits in certain cases.
-
PSBM-96919
ploop: resize operation could fail due to an incorrect check in ploop1_allocate().
-
CVE-2018-14734
infiniband: use-after-free in ucma_leave_multicast().
It was found that ucma_leave_multicast() function from 'rdma_ucm' module could try to access a certain data structure after the structure had been freed. This allows an attacker to induce kernel memory corruption, leading to a system crash or other unspecified impact.
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14734
-
CVE-2019-5489
Page cache side channel attacks via mincore().
It was discovered that a local attacker could exploit mincore() system call to obtain information about memory pages of the running applications from the page cache even if the contents of these memory pages were not available to the attacker.
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-5489
-
PSBM-96533
The warning in mem_cgroup_reparent_charges() was triggered too early and too often in certain cases.
-
PSBM-96262
kvm: potential system hang due to an error in mmu_shrink_scan().
-
CVE-2018-16871
nfs: NULL pointer dereference due to an anomalized NFS message sequence.
An attacker, who is able to mount an exported NFS filesystem, is able to trigger a null pointer dereference by using an invalid NFS sequence. This can panic the machine and deny access to the NFS server. Any outstanding disk writes to the NFS server will be lost.
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16871
-
VSTOR-24004
Storage: certain errors in CS caused by power failures were not handled properly.
It was discovered that if a file located on Virtuozzo Storage cluster was reopened, the kernel could reuse its mappings without notifying MDS. As a result, if errors were then detected on a CS, for example, caused by power failures, the userspace components would be unable to handle them properly.
-
PSBM-96057
Processes could get stuck in copy_net_ns() forever.
-
PSBM-95815
vziolimit: kernel crash due to a division by zero in throttle_charge().
-
PSBM-95772
pcompact operation is much slower for the containers on Virtuozzo Storage than for the ones stored locally.