Kernel Exploit Affecting OpenVZ Providers - node crash (CVE-2013-2224)

jake · July 2013

Hey Guys,

Doing my regular rounds of weekend forum surfing, I found this thread created by Steven/Rack911 at Wht. Haven't seen this posted on Let yet... guess this gives me an excuse to finally sign up and make a post! ;-) I figured this is important to note considering there are a bunch of OpenVZ providers who hang out here.

CVE-2013-2224

--

We discovered a kernel exploit today.. Its been reported to Redhat, etc. and waiting to hear back from them..

This exploit will crash centos 6 machines and cause them to reboot and it will actually crash and reboot an entire openvz node when ran inside a vps running on the node.
Openvz 5 is affected since the required elements were backported into it. RHEL/Centos 5 is not affected.

More details coming soon.

In the mean time tortiselabs/nenolod released a temporary patch you can compile into your kernel: http://turtle.dereferenced.org/~nenolod/hemlock-fix.patch

Maounique · July 2013

So, I guess someone was after us with all these reboots we had...
As i suspsected but uncle thinks I am paranoid (not that I disagree, just at times paranoia is proven right :P).

FRCorey · July 2013

This is what we keep ksplice going for, because there's a crash bug softlock in OpenVZ that still has not been resolved and many hosts just cant upgrade right now. Irritating. At least security exploits get handled through kSplice