The openbyhandleat function in vzkernel before 042stab090.5 in the OpenVZ modification for the Linux kernel 2.6.32, when using simfs, might allow local container users with CAPDACREADSEARCH capability to bypass an intended container protection mechanism and access arbitrary files on a filesystem via vectors related to use of the filehandle structure.

vzctl before 4.9.4 determines the virtual environment (VE) layout based on the presence of root.hdd/DiskDescriptor.xml in the VE private directory, which allows local simfs container (CT) root users to change the root password for arbitrary ploop containers, as demonstrated by a symlink attack on the ploop container root.hdd file and then access a control panel.

An unspecified Enghouse Interactive Professional Services "addon product" in Enghouse Interactive IVR Pro (VIP2000) 9.0.3 (rel903), when using OpenVZ and fallback customization, uses the same SSH private key across different customers' installations, which allows remote attackers to gain privileges by leveraging knowledge of this key.

vzkernel before 042stab080.2 in the OpenVZ modification for the Linux kernel 2.6.32 does not initialize certain length variables, which allows local users to obtain sensitive information from kernel stack memory via (1) a crafted ploop driver ioctl call, related to the ploopgetdeviceioc function in drivers/block/ploop/dev.c, or (2) a crafted quotactl system call, related to the compatquotactl function in fs/quota/quota.c.

Description of problem: OpenVZ linux kernel team has found deadlock between ptrace and coredump code, no root privileges required.

2.6.18-128.1.10.el5 affected, exploit in attach.

--- SysRq-T trace:

explzap3 R ffff81003fa6cd70 0 8645 10409 8646 (NOTLB) 0000000000000068 ffffffff8006358b ffff81007e13f980 0000000000000000 ffff81003fa6cd70 ffff81003fa6cd70 0000013e867d5d52 0000027bcf133f75 ffff81003fa6cf80 ffffffff8046b780 ffffffff802fa680 ffff81003d0f1ec8 Call Trace: [<ffffffff8006358b>] schedtextstart+0x11b/0xfcb [<ffffffff800863c2>] taskrqlock+0x26/0x45 [<ffffffff80088be2>] sysschedyield+0xb1/0xb8 [<ffffffff800c8fa8>] ptracestart+0x3bd/0x465 [<ffffffff80029223>] dowait+0xafd/0xb99 [<ffffffff800c9cfb>] sysptrace+0x48/0x1f7 [<ffffffff80060477>] ptregscallcommon+0x67/0xac [<ffffffff80060166>] systemcall+0x7e/0x83

explzap3 D ffff81007ff395c0 0 8647 8645 8646 (NOTLB) ffff81007f6abc58 0000000000000086 0000000000000006 ffff81007b944c30 ffff81007ff395c0 ffff81007ff33500 0000004ed2555339 0000009d55ffa665 ffff81007ff397c8 ffffffff8046b780 0000004ed2554f5e ffff81007ff33500 Call Trace: [<ffffffff80086900>] activatetask+0x92/0x157 [<ffffffff800492ac>] trytowakeup+0x3ce/0x3e0 [<ffffffff80064691>] waitforcompletion+0x79/0xa2 [<ffffffff80088417>] defaultwakefunction+0x0/0xe [<ffffffff800ecbb5>] docoredump+0x341/0x8a1 [<ffffffff800a32e5>] ubslabuncharge+0xd0/0xdb [<ffffffff800a3493>] doubsiginfouncharge+0x42/0x55 [<ffffffff80096391>] recalcsigpending+0xe/0x25 [<ffffffff8002c00a>] getsignaltodeliver+0x434/0x46b [<ffffffff8005d8f6>] donotifyresume+0xd0/0x7e3 [<ffffffff80096f63>] groupsendsiginfo+0x89/0x94 [<ffffffff8005d26a>] groupsendsiginfo+0x76/0x83 [<ffffffff80088a0d>] vcpuput+0x8e/0x16e [<ffffffff8004ea1d>] syskill+0x19f/0x1b2 [<ffffffff80088a0d>] vcpuput+0x8e/0x16e [<ffffffff800601ef>] sysretsignal+0x1c/0x27 [<ffffffff80060477>] ptregscallcommon+0x67/0xac