10/28/14 Virtuozzo Container Breakout (#PSBM-29594

[Geek]

http://kb.sp.parallels.com/en/123301 --- will probably start to see patches from KC/KS in the next couple hours (hopefully)

• A vulnerability in the RHEL6-based kernel discovered during internal security audit could allow access to the host filesystem from inside a Container. Only the kernels from 2.6.32-042stab057.1 to 2.6.32-042stab093.5 are affected. Kernel update is highly recommended. (#PSBM-29594)
  

 

[Francisco]

It could be that it only affects Virtuozzo.

They don't use SIMFS, they use some funky overlay/hardlinks deal.

Francisco

 

[Geek]

It could be that it only affects Virtuozzo.


They don't use SIMFS, they use some funky overlay/hardlinks deal.


Francisco

Possibly.  I've been going back and forth on Skype with one of the OpenVZ contributors who works with Kir and Konstantin, and the rest... and they're saying that ||s is being particularly quiet about this one, but to watch for updates regardless.  If that's true, at least it was revealed as part of their audit procedures.  -JE

 

[Geek]

Crap. Well, at least it was discovered internally.

Virtuozzo core update 2.6.32-042stab094.7 2014-10-28 
This update includes a new Parallels Virtuozzo 
Containers for Linux 4.7 kernel (2.6.32-042stab090.5)
based on the Red Hat Enterprise Linux 6.5 kernel 
(2.6.32-431.17.1.el6). The new kernel introduces a security fix: - A critical vulnerability in the legacy simfs Container filesystem was fixed. Containers based on vzfs and ploop filesystems were not affected.

 

[Francisco]

Crap. Well, at least it was discovered internally.

Virtuozzo core update 2.6.32-042stab094.7 2014-10-28 

This update includes a new Parallels Virtuozzo 

Containers for Linux 4.7 kernel (2.6.32-042stab090.5)

based on the Red Hat Enterprise Linux 6.5 kernel 

(2.6.32-431.17.1.el6). The new kernel introduces a security fix: - A critical vulnerability in the legacy simfs Container filesystem was fixed. Containers based on vzfs and ploop filesystems were not affected.

Goddammit.

I guess back I go to testing ploop some more.

Francisco