[SOLVED] CVE-2026-99999 or the Vercel KVM Zero-Day

J

joru

Member
Oct 4, 2023
5
2
8
After the news of a possible KVM escape made the rounds at the start of the month, we finally got some more information and a patch to fix it:
I'm sure that a patch release for the proxmox kernel is already on its way, but could you still clear up a few things beforehand?
  • When can we expect a new release for the kernel package?
  • Which versions of the proxmox-kernel packages will be patched?
  • Will the latest kernel for proxmox ve 8 still be patched, even though it is not officially supported anymore?
Not all of our systems can be restarted without some planning and notifying people, a rough timeline would be greatly appreciated!
 
the fix is included in proxmox-kernel-7.0.14-24-pve(-signed), which is currently available up to the pve-no-subscription repository and will hit enterprise soon.

the 7.0.14 series is the only currently supported kernel series, there won't be updates for EOL kernel series or product releaess.
 
  • Like
Reactions: debian10, wech, Gilou and 1 other person
It's available now on enterprise as well.

Unfortunately, the nvidia driver (tried the newest 615.78.08) is not compiling for kernel 7.0.14-24-pve, lots of "error: field ‘cxlds’ has incomplete type".
 
fabian said:
the fix is included in proxmox-kernel-7.0.14-24-pve(-signed), which is currently available up to the pve-no-subscription repository and will hit enterprise soon.

the 7.0.14 series is the only currently supported kernel series, there won't be updates for EOL kernel series or product releaess.
Click to expand...

Hello,
Thank you for prompt action.
Is there a way to patch this vulnerability without rebooting the host server?
 
debian10 said:
Is there a way to patch this vulnerability without rebooting the host server?
Click to expand...
No, like every kernel update you need to reboot have the new kernel running. If you have more than one node you could migrate your workloads to the other before and after the reboot.
 
  • Like
Reactions: leesteken
Johannes S said:
No, like every kernel update you need to reboot have the new kernel running. If you have more than one node you could migrate your workloads to the other before and after the reboot.
Click to expand...

I’m aware of that. However, given the growing number of kernel vulnerabilities, the need for live kernel patching is becoming more important than ever.
 
debian10 said:
I’m aware of that. However, given the growing number of kernel vulnerabilities, the need for live kernel patching is becoming more important than ever.
Click to expand...
Not really. Even with live-patching you have a ( allthough smaller ) downtime and usually something like kernelcare addresses only some but not all issues. Live patching is NOT an universal bandaid for currents worst practices of compilance-theater-bullshit-regulated enterprise it.
 
You must log in or register to reply here.
Top Bottom
Back