Article ID: 119551, created on Jan 9, 2014, last review on May 11, 2014

  • Applies to:
  • Virtuozzo containers for Linux 4.6
-----------------------------------------------------------------------
Synopsis:          The new Parallels Virtuozzo Containers 4.6 kernel
                   provides an update with security and stability fixes.
Product:           Parallels Virtuozzo Containers 4.6
Keywords:          'bugfix' 'security'

-----------------------------------------------------------------------

This document provides information on the new Virtuozzo Containers 4.6 kernel,
version 2.6.18-028stab110.1.

--------------------------------------------------------------------------------
TABLE OF CONTENTS

1. About This Release
2. Updates Description
3. Obtaining New Kernel
4. References

--------------------------------------------------------------------------------

1. ABOUT THIS RELEASE

The current update for the Parallels Virtuozzo Containers 4.6 kernel provides
a new kernel based on the Red Hat Enterprise Linux 5.10 kernel 
(2.6.18-371.3.1.el5). The updated kernel includes a number of security and
stability fixes.

--------------------------------------------------------------------------------

2. UPDATES DESCRIPTION

This update fixes the following issue:

- The futex subcommand (FUTEX_WAIT_BITSET & FUTEX_CLOCK_REALTIME)
  broken in 028stab108 kernel (OVZ-2806)

The new kernel includes a number of security fixes from Red Hat Enterprise
Linux 5 kernels:

- A use-after-free flaw was found in the madvise() system call
  implementation in the Linux kernel. A local, unprivileged user could use
  this flaw to cause a denial of service or, potentially, escalate their
  privileges. (CVE-2012-3511, 2.6.18-348.18.1.el5)

- A flaw was found in the way the Linux kernel's TCP/IP protocol suite
  implementation handled IPv6 sockets that used the UDP_CORK option. A local,
  unprivileged user could use this flaw to cause a denial of service.
  (CVE-2013-4162, 2.6.18-348.18.1.el5)

- An information leak flaw in the Linux kernel could allow a local,
  unprivileged user to leak kernel memory to user-space.
  (CVE-2013-2141, 2.6.18-348.18.1.el5)

- It was found that a deadlock could occur in the Out of Memory (OOM)
  killer. A process could trigger this deadlock by consuming a large amount
  of memory, and then causing request_module() to be called. A local,
  unprivileged user could use this flaw to cause a denial of service
  (excessive memory consumption). (CVE-2012-4398, 2.6.18-371.el5)

- A flaw was found in the way the Linux kernel handled the creation of
  temporary IPv6 addresses. If the IPv6 privacy extension was enabled
  (/proc/sys/net/ipv6/conf/eth0/use_tempaddr is set to '2'), an attacker on
  the local network could disable IPv6 temporary address generation, leading
  to a potential information disclosure. (CVE-2013-0343, 2.6.18-371.1.2.el5)

- An information leak flaw was found in the way Linux kernel's device
  mapper subsystem, under certain conditions, interpreted data written to
  snapshot block devices. An attacker could use this flaw to read data from
  disk blocks in free space, which are normally inaccessible. 
  (CVE-2013-4299, 2.6.18-371.1.2.el5)

- An off-by-one flaw was found in the way the ANSI CPRNG implementation in
  the Linux kernel processed non-block size aligned requests. This could lead
  to random numbers being generated with less bits of entropy than expected
  when ANSI CPRNG was used. (CVE-2013-4345, 2.6.18-371.1.2.el5)

--------------------------------------------------------------------------------

3. OBTAINING NEW KERNEL

You can download and install this kernel update using the vzup2date utility
included in the Parallels Virtuozzo Containers 4.6 distribution set.

--------------------------------------------------------------------------------

4. REFERENCES

http://rhn.redhat.com/errata/RHSA-2013-1292.html
http://rhn.redhat.com/errata/RHSA-2013-1348.html
http://rhn.redhat.com/errata/RHSA-2013-1449.html
http://rhn.redhat.com/errata/RHSA-2013-1790.html

https://www.redhat.com/security/data/cve/CVE-2012-3511.html
https://www.redhat.com/security/data/cve/CVE-2013-0343.html
https://www.redhat.com/security/data/cve/CVE-2013-2141.html
https://www.redhat.com/security/data/cve/CVE-2013-4162.html
https://www.redhat.com/security/data/cve/CVE-2013-4299.html
https://www.redhat.com/security/data/cve/CVE-2013-4345.html
https://www.redhat.com/security/data/cve/CVE-2013-4398.html

--------------------------------------------------------------------------------
Copyright (c) 1999-2014 Parallels IP Holdings GmbH and its affiliates.
All rights reserved.

36627b12981f68a16405a79233409a5e 2897d76d56d2010f4e3a28f864d69223 d02f9caf3e11b191a38179103495106f e8e50b42231236b82df27684e7ec0beb

Email subscription for changes to this article
Save as PDF