Article ID: 6883, created on Nov 6, 2009, last review on May 9, 2014

  • Applies to:
  • Virtuozzo for Linux 3.x

Release notes

--------------------------------------------------------------------------------
Synopsis:         New Virtuozzo 3.0 kernel provides a fix for an important
                           security vulnerability.
Issue date:       2009-11-06
Product:            Virtuozzo 3.0
Keywords:        security updates
--------------------------------------------------------------------------------

This document provides information on the new Virtuozzo 3.0 kernel, version
2.6.9-023stab051.3.

© 1999-2009 Parallels Holdings, Ltd. and its affiliates. All rights reserved.

--------------------------------------------------------------------------------

TABLE OF CONTENTS

1. About This Release
2. Updates Description
3. Bugs Fixed
4. Obtaining New Kernel
5. Installing New Kernel
6. Required RPMs
7. Reference List

--------------------------------------------------------------------------------

1. ABOUT THIS RELEASE

The current update for the Virtuozzo 3.0 kernel provides a fix for an important
security vulnerability.

--------------------------------------------------------------------------------

2. UPDATES DESCRIPTION

The updated Virtuozzo 3.0 kernel includes a fix for the following security
vulnerability fixed in the 2.6.9-89.0.16.EL Red Hat kernel:

- A NULL pointer dereference flaw was found in each of the following functions
  in the Linux kernel: pipe_read_open(), pipe_write_open(), and
  pipe_rdwr_open(). When the mutex lock is not held, the i_pipe pointer could
  be released by other processes before it is used to update the pipe's reader
  and writer counters. This could lead to a local denial of service or
  privilege escalation. (CVE-2009-3547, Important)


We highly recommend that all Virtuozzo 3.0 users update their kernel to the
latest version.

--------------------------------------------------------------------------------

3. BUGS FIXED

The following bug from the previous release has been fixed in the new
Virtuozzo 3.0 kernel:

- #456381: A kernel panic due to a NULL pointer dereference in pipe_rdwr_open()
           (CVE-2009-3547)


The following OpenVZ bug has been fixed:

- #1358: "OpenVZ 2.6.18-x"-based kernels are vulnerable to CVE-2009-3547.

--------------------------------------------------------------------------------

4. OBTAINING NEW KERNEL

You can download and install the kernel update by using the vzup2date utility
included in the Virtuozzo 3.0 distribution set.

--------------------------------------------------------------------------------

5. INSTALLING NEW KERNEL

To install the update, perform the following operations:

I. Use the "rpm -ihv" command to install the new kernel and Virtuozzo modules.

# rpm -ivh vzkernel-smp-2.6.9-023stab051.3.i686.rpm \
vzmodules-smp-2.6.9-023stab051.3.i686.rpm
Preparing...                ################################# [100%]
    1:vzkernel-smp           ################################# [50%]
    2:vzmodules-smp          ################################# [100%]

    Please DO NOT USE the "rpm -Uhv" command to install the kernel. Otherwise,
    all the kernels previously installed on your system may be removed from
    the Hardware Node.

II. You can adjust your boot loader configuration file to have the new kernel
    loaded by default. If you use the LILO bootloader, please do not forget to
    execute the 'lilo' command to write the changes to the boot sector:

     # lilo
     Added Virtuozzo2 *
     Added Virtuozzo1
     Added linux
     Added linux-up

III. Reboot your computer with the "shutdown -r now" command to boot the new
     kernel.

--------------------------------------------------------------------------------

6. REQUIRED RPMS

Depending on the kind of processor on your Hardware Node, the following RPM
packages are included in the kernel update:

x86 kernels:

- Uniprocessor:
   vzkernel-2.6.9-023stab051.3.i686.rpm
   vzmodules-2.6.9-023stab051.3.i686.rpm

- SMP:
   vzkernel-smp-2.6.9-023stab051.3.i686.rpm
   vzmodules-smp-2.6.9-023stab051.3.i686.rpm

- Enterprise:
   vzkernel-enterprise-2.6.9-023stab051.3.i686.rpm
   vzmodules-enterprise-2.6.9-023stab051.3.i686.rpm

- Enterprise with the 4GB split feature disabled:
   vzkernel-entnosplit-2.6.9-023stab051.3.i686.rpm
   vzmodules-entnosplit-2.6.9-023stab051.3.i686.rpm


x86_64 kernels:

- Uniprocessor:
   vzkernel-2.6.9-023stab051.3.x86_64.rpm
   vzmodules-2.6.9-023stab051.3.x86_64.rpm

- SMP:
   vzkernel-smp-2.6.9-023stab051.3.x86_64.rpm
   vzmodules-smp-2.6.9-023stab051.3.x86_64.rpm

--------------------------------------------------------------------------------

7. REFERENCE LIST

The following references have been used in this document:

https://rhn.redhat.com/errata/RHSA-2009-1541.html

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3547

9b9439294978ca011521bd467a069524 d02f9caf3e11b191a38179103495106f e8e50b42231236b82df27684e7ec0beb 2897d76d56d2010f4e3a28f864d69223

Email subscription for changes to this article
Save as PDF