Ghostlock - (CVE-2026-43499 ) OpenVZ 7 Patch
Sí, lo de siempre, mucho jaleo esta vez, un bug gordo que afecta a OpenVZ
Todavía habemos gente que gestionamos algunos nodos con OpenVZ7 y no se sabe si sacarán un backport
Así que dejo aquí uno:
From 1fa0a12de3aca9816a9d953b1af395bcdb20901c Mon Sep 17 00:00:00 2001
From: Keenan Dong <keenanat2000@gmail.com>
Date: Wed, 8 Apr 2026 16:46:00 +0800
Subject: [PATCH] rtmutex: Use waiter::task instead of current in
remove_waiter()
remove_waiter() is used by the slowlock paths, but it is also used for
proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from
futex_requeue().
In the latter case waiter::task is not current, but remove_waiter()
operates on current for the dequeue operation. That results in several
problems:
1) the rbtree dequeue happens without waiter::task::pi_lock being held
2) the waiter task's pi_blocked_on state is not cleared, which leaves a
dangling pointer primed for UAF around.
3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter
task
Use waiter::task instead of current in all related operations in
remove_waiter() to cure those problems.
[ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the
changelog ]
Fixes: 8161239a8bcc ("rtmutex: Simplify PI algorithm and make highest prio task get lock")
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Signed-off-by: Keenan Dong <keenanat2000@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
[ OpenVZ 7 backport: retain struct rt_mutex and explicit
raw_spin_lock_irqsave() APIs from the 3.10 tree instead of the modern
struct rt_mutex_base and scoped_guard() APIs. ]
(cherry picked from commit 3bfdc63936dd4773109b7b8c280c0f3b5ae7d349)
---
kernel/rtmutex.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/kernel/rtmutex.c b/kernel/rtmutex.c
index 6131a046aab..3ed572ecdb8 100644
--- a/kernel/rtmutex.c
+++ b/kernel/rtmutex.c
@@ -604,19 +604,22 @@ static void mark_wakeup_next_waiter(struct wake_q_head *wake_q,
*
* Must be called with lock->wait_lock held and
* have just failed to try_to_take_rt_mutex().
+ *
+ * When invoked from rt_mutex_start_proxy_lock() waiter->task != current!
*/
static void remove_waiter(struct rt_mutex *lock,
struct rt_mutex_waiter *waiter)
{
int first = (waiter == rt_mutex_top_waiter(lock));
struct task_struct *owner = rt_mutex_owner(lock);
+ struct task_struct *waiter_task = waiter->task;
unsigned long flags;
int chain_walk = 0;
- raw_spin_lock_irqsave(¤t->pi_lock, flags);
+ raw_spin_lock_irqsave(&waiter_task->pi_lock, flags);
rt_mutex_dequeue(lock, waiter);
- current->pi_blocked_on = NULL;
- raw_spin_unlock_irqrestore(¤t->pi_lock, flags);
+ waiter_task->pi_blocked_on = NULL;
+ raw_spin_unlock_irqrestore(&waiter_task->pi_lock, flags);
if (!owner)
return;
@@ -649,7 +652,7 @@ static void remove_waiter(struct rt_mutex *lock,
raw_spin_unlock(&lock->wait_lock);
- rt_mutex_adjust_prio_chain(owner, 0, lock, NULL, current);
+ rt_mutex_adjust_prio_chain(owner, 0, lock, NULL, waiter_task);
raw_spin_lock(&lock->wait_lock);
}
--
2.53.0
Es un backport para el 3.10 basado en el parche oficial: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=88614876370aac8ad1050ad785a4c095ba17ac11
Lo he compilado y desplegado el kernel en varios nodos.
Esto soluciona CVE-2026-43499 en Openvz7 con el kernel 3.10.x
RECOMIENDO compilar tu propio kernel, pero si no tienes tiempo y quieres un RPM para desplegar:
Descargar RPM: https://skamasle.com/rpm/x86_64/vzkernel/vzkernel-3.10.0-1160.129.1.vz7.226.2.compiled.by.skamasle.com.x86_64.rpm
SHA256: 0406991a045d7ea78bab8703c3c8982a8dfe9fb94931fadb1423bbd7bbc5ddc8
Si necesitas los headers, el devel, kernel-tools etc:
https://skamasle.com/rpm/x86_64/vzkernel/
Descargar he instalar: rpm -ihv vzkernel-3.10.0-1160.129.1.vz7.226.2.compiled.by.skamasle.com.x86_64.rpm
Ejecuta bajo tu propio riesgo, el kernel ha sido probado en producción, pero si tienes problemas te tendrás que sacar las castañas del fuego, en todo caso, como he dicho, descarga el patch, aplica lo y y compila.
El rtmutex.c parcheado puedes descargarlo desde aquí: https://skamasle.com/rpm/source/rtmutex.c ( Valido para centos 7, OVZ7 etc )
Descargar RPM para instalar : aquí