Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth
- Thread starter pve7bug
- Start date
problem confirmed: https://forum.proxmox.com/threads/p...security-advisories.149331/page-4#post-867929
on
dpkg-query -W libpve-a*
libpve-access-control 6.4-3
the server was hacked too
on
dpkg-query -W libpve-a*
libpve-access-control 6.4-3
the server was hacked too
Last edited:
Thanks to the Proxmox team for reviewing my report. At least they took it seriously, unlike the users on this forum who think that a Debian 11 installation is hacked simply because it's EOL (and no, the OpenSSH bug doesn't affect Debian 11; it's too old for this version).
Next time someone reports something like this, your guys should take it differently, since I never spoke rudely to anyone, and as I said in my previous posts, 70% of the internet runs on EOL.
Next time someone reports something like this, your guys should take it differently, since I never spoke rudely to anyone, and as I said in my previous posts, 70% of the internet runs on EOL.
Then you are still vulnerable due to the known and unknown security issues in PVE8 (which is EOL) and Debian Bookworm. The fix is to upgrade to the latest supported version of PVE aka PVE9 with every updated installed. Everything else is just gross negelect.
Nobody refuse to acknowledge this. Basically everybody of the "toxic veteran users" said rightfully, that any non-supported version will have known and unknown security issues thus it's bad practice to run such versions. And it's not "shifting blame", running an EOL-Version isn't something the "toxic veterans" or Proxmox developers have any fault in but the moronic "Never change a running system"-mentality in Enterprise change damagment.
So it's not "avoiding the actual issue", we just disagree what the actual issue is: Missmanagement or that EOL software is a bad actors paradise.
Just for the record: Neither I not one of the other "toxic veterans" in this thread are members of the Proxmox team. Their official report is quite professional and I see no reason, that they don't take the issue seriously. They just (rightfully) point out, that for a durable fix people need to update to a newer version since " No supported Proxmox VE release is affected." (quote from the Proxmox Teams security announcement)
And that 70% of the Internet runs on EOL (is this really the case though? I hope not! It's bad enough that enterprises still believe in perimeter security and don't patch their internal networks) might be true or not but that doesn't make it a good idea to do it.
It baffles me, that calling out worst practice in security and patch management is "not taking issues seriously". I take personal offense in this: My (to be fair quite strong) opinion comes from taking security issues more seriously than the "change is bad"-mentality of "enterprise-grade change management" bullshit.
Last edited:
So, you now got your security advisory for a vulnerability, in a over three year old version of a software component, which was at the time it would have been relevant neither internally discovered nor from anyone reported and hopefully also not exploited.
If people would not run EOL software, that vulnerability would have presumably never been discovered and, way more importantly, never been exploited in the first place...
So, what now? Do you now search for more undiscovered vulnerabilities in every single EOL linux package? Do the same on BSD? On old, EOL Windows versions? What is the point of all of this here?
TL;DR: If everyone had everytime upgraded their systems to a supported version, they had not run into this situation at all now...
The *immediate* fix, then.
Yes, absolutely, you should be on PVE 9 by now. I don't think anyone is contesting that.
I understand your frustration around change management. Most businesses should have either certifications or insurance that mandates not running EOL software to begin with. If you do IT for a living and you get pushback for upgrading, remind your bosses of that.
Sometimes there are reasons you can't upgrade, but in those cases, software should not be connected to the public internet. And certainly not with open ports!
If everyone followed these best practices, we'd never have any issues, but sadly that is not the reality. Sometimes you have to fight a fire on something you weren't responsible for, as an example.
nice work! and proxmox also posted a security bulletin, great to see all around
respectfully disagree, although proxmox updated the package for other reasons they did not know of the vulnerability at the time, it is important to research why to improve code in the future, as well to diagnose if it has actually been fixed in a supported version
proxmox-ve 7.2-1
pve-manager 7.4-20
on OVH, happened to me as well, no matter if software was EOL or not, proxmox does not feel secure anymore
pve-manager 7.4-20
on OVH, happened to me as well, no matter if software was EOL or not, proxmox does not feel secure anymore
What could be done to improve your feeling? Maybe switch to HyperV or VMware or Citrix and connect them directly to the internet without updating for years? I don't expect anyone to not update those for years at a time. How's Proxmox different?
EDIT: Are Proxmox major updates too complicated/risky/much work? Do the other hypervisors update automatically? Do they come with people who do it for you? Does their software simply stop working when not updated, to force you? How could this upgrade situation be improved? (general question to everyone running old versions)
Last edited:
These days... practically nothing is certain, especially with so many entrepreneurs out there. And so many outdated systems that aren't updated. It's not one tool or another... it's just a series of oversights that lead to disaster.
IncusOS does. But it's API-driven without ssh access and has a quite limited WebUI, so nothing for ClickOPS people
Proxmox VE can be configured to update automatically (see "apt info unattended-upgrades"). This is a Debian feature and I think there are good reasons for it to not be enabled by default (e.g. you don't know what else the admin has installed, do you want it to reboot automatically or not, etc).
This won't save you from running EOL versions though. That's still the admin's problem.
This won't save you from running EOL versions though. That's still the admin's problem.
Yes, but also no.
Expecting and depending on your software to be faultproof is a fools errand. Yes, you should close doors you are aware that are open but that doesnt absolve you from all the doors you are NOT aware of. The "crime" here wasnt that OP was running an OOS operating system, it was the he had it exposed to the internet.
Good security hygiene dictates you assume you're always vulnerable, and put all layers of protection above it as is practicable- and you can still get hit because the number ONE method of penetration is social engineering, and that is really hard to combat
Assuming its not the latter, OP could still have gotten pwned simply because he wasnt firewalled.Indeed! The alternative is to use VMWare!
CVE-2021-22005
CVE-2021-21972
CVE-2021-21985
CVE-2023-34048
i understand, i get you, if i would have auto updated daily are you sure that this would not happen? we do not know the exact 0day triggered
It's probably this one: https://forum.proxmox.com/threads/p...security-advisories.149331/page-4#post-867929 (it's not a zero-day but it's game over anyway)
What do people think would help to improve the upgrade process (compared to other hypervisors)?
If you were on 7.0 you would be affected but honestly that’s irrelevant. The most important lesson from this is that port 8006 should have a firewall in front of it. Pretty much all other hypervisors have had a vulnerability like that and that’s why every HV should have only local access.
“But OVH doesn’t have a firewall service and my home IP address is dynamic”
A simple Linux server with public IP address running openvpn service will take care of that.
A little more empathy from the community would be helpful. Sometimes we get too comfortable and make comments like some of those we've seen in this thread over the past two days. Is there already a "frontline" group that updates and documents the difficulties or challenges faced during the upgrade? I confess that sometimes I'm so afraid of upgrading, especially to newer versions, that I prefer a clean install and migrating each machine individually (maybe "empathy" helps... but sometimes a troll encourages you to do better).
Empathy, which I think comes after the problem, might improve the tone of the discussion here. But how could Proxmox change things to prevent people from upgrading before the problems start? I feel like going from one major release to the next really does not look or feel that different. Even though the Debian major version changed and often the kernel version jumped (but was often available as opt-in much earlier).
Maybe Proxmox should present itself more as a rolling release and hide the Debian major version under the rug? A few more touches to automate the process and maybe pretend that there is no Linux under the hood would help? Maybe an upgrade GUI (with automated changes) instead of a Wiki page with lots of known issues?
EDIT: Would Proxmox be taken more seriously when it would take away the user's ability to control and customize it (based on GNU/Linux and OSS)? More like an enterprise appliance where you are used to pay a service technician to update it regularly? At least your setup would be "in the hands of professionals". I'm using hyperbole and satire here but maybe it would match better with the expectations created by other hypervisors? Regardless of my weird ideas, what would help people to stay up to date?
Maybe Proxmox should present itself more as a rolling release and hide the Debian major version under the rug? A few more touches to automate the process and maybe pretend that there is no Linux under the hood would help? Maybe an upgrade GUI (with automated changes) instead of a Wiki page with lots of known issues?
EDIT: Would Proxmox be taken more seriously when it would take away the user's ability to control and customize it (based on GNU/Linux and OSS)? More like an enterprise appliance where you are used to pay a service technician to update it regularly? At least your setup would be "in the hands of professionals". I'm using hyperbole and satire here but maybe it would match better with the expectations created by other hypervisors? Regardless of my weird ideas, what would help people to stay up to date?
Last edited: