Virtuozzo 7 : readykernel-patch (VZA-2019-006)

Low Nessus Plugin ID 133451

Synopsis

The remote Virtuozzo host is missing a security update.

Description

According to the version of the vzkernel package and the readykernel-patch installed, the Virtuozzo installation on the remote host is affected by the following vulnerability :

- A flaw was found in the implementation of userfaultfd.
An attacker is able to bypass file permissions on filesystems mounted with tmpfs/hugetlbs to modify a file and possibly disrupt normal system behaviour. At this time there is an understanding there is no crash or priviledge escalation but the impact of modifications on these filesystems of files in production systems may have adverse affects.

Note that Tenable Network Security has extracted the preceding description block directly from the Virtuozzo security advisory.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

Update the readykernel patch.

See Also

https://virtuozzosupport.force.com/s/article/VZA-2019-006

https://bugzilla.redhat.com/show_bug.cgi?id=1641548

http://www.nessus.org/u?9219887e

http://www.nessus.org/u?0756d063

http://www.nessus.org/u?1590c30d

http://www.nessus.org/u?2dca2d49

http://www.nessus.org/u?3f485927

http://www.nessus.org/u?699a3a98

http://www.nessus.org/u?ab5fc4d9

http://www.nessus.org/u?a2f4cb56

Plugin Details

Severity: Low

ID: 133451

File Name: Virtuozzo_VZA-2019-006.nasl

Version: 1.2

Type: local

Published: 2020/02/04

Updated: 2020/02/07

Dependencies: 12634

Risk Information

Risk Factor: Low

CVSS v2.0

Base Score: 2.1

Temporal Score: 1.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:N

Temporal Vector: CVSS2#E:POC/RL:OF/RC:C

CVSS v3.0

Base Score: 5.5

Temporal Score: 5

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:virtuozzo:virtuozzo:readykernel, cpe:/o:virtuozzo:virtuozzo:7

Required KB Items: Host/local_checks_enabled, Host/Virtuozzo/release, Host/Virtuozzo/rpm-list, Host/readykernel-info

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2019/02/07

Reference Information

CVE: CVE-2018-18397