Bugzilla Bug 131427

vserver-sources is prone to multiple local privilege escalation
vulnerabilities.

Inside a Virtual Private Server the distinction between the root user and a
normal user is lost with regard to the following (vserver specific)
capabilites:

- VXC_SET_UTSNAME: Allow setdomainname(2) and sethostname(2)
- VXC_SET_RLIMIT: Allow setrlimit(2)
- VXC_SYSLOG: Allow syslog(2)
- VXC_SECURE_MOUNT: Allow secure mount(2)
- VXC_SECURE_REMOUNT: Allow secure remount
- VXC_BINARY_MOUNT: Allow binary/network mounts
- VXC_QUOTA_CTL: Allow quota ioctl

All versions in portage are currently affected.

We are still awaiting the proper fix from upstream, which should be available
in the next 24 hours i guess.

Jan R

Jan Rêkorajski (baggins@pld-linux.org) on irc.oftc.net#vserver reported this
issue

CCing phreak as second maintainer, please provide fixed ebuids but commit only
if the fix/new version is public, thanks.

The fix was released upstream in 2.0.2_rc18/2.1.1_rc18 (~arch) which are now in
portage, additionally i have bumped 2.0.1 (arch) to -r4 with the fix
backported.

A more detailed description of the bug can be found at
http://www.paul.sladen.org/vserver/archives/200604/0323.html

This is a kernel issue.

is there anything preventing the GLSA to be issued?

I see no problem with doing a GLSA for this one issue as it only affects one
sourceset, if you so wish, but we haven't done Kernel GLSAs since 200408 :)

oh, ok.. then the issue is fixed :)

Fixed then :)