OpenVZ Forum


Home » General » Support » Urgent: GhostLock (CVE-2026-43499) on OpenVZ 7 Where is the patch for WebPros / SolusVM users?
Re: Urgent: GhostLock (CVE-2026-43499) on OpenVZ 7 Where is the patch for WebPros / SolusVM users? [message #53892 is a reply to message #53891] Sun, 12 July 2026 00:44 Go to previous messageGo to previous message
dmc_dtc is currently offline  dmc_dtc
Messages: 21
Registered: May 2014
Location: Serbia
Junior Member
I am not related nor associated with OpenVZ team, just a long time user here.

I knew this would happen sooner or later - some big vulnerability and no patch form OpenVZ (yet)... Last time we got lucky because kernel 3.10 was not affected by copyfail and some other vulnerabilities.

So i did some research when copyfail striked, and found out their OpenVZ repo on bitbucket where they are still actually commit patches before release (latest is in april 2026)

you can download latest branch (as of this writing) from https://bitbucket.org/openvz/vzkernel/src/branch-rh7-3.10.0- 1160.129.1.vz7.226.x-ovz/

Use

git clone -b branch-rh7-3.10.0-1160.129.1.vz7.226.x-ovz --single-branch --depth 1 https://YOURUSERNAME@bitbucket.org/openvz/vzkernel.git

Then you have latest unreleased OpenVZ kernel

So latest official release is 1160.119 - But in this repo it is 129 version - there are already patches missing from official release but nevertheless there is no patch for GhostLock (yet)

So - i made one with help of Claude Very Happy and apparently i was successful but still haven't tested it in production to see if every software that uses mutex works - but proof of concept from nebula no longer works and all tests show that all mutex related things works, so i think this should work.. of course, consider this no warranty and not 100% tested patch but it seems to work - use on your own responsibility - here is instruction how to compile your own kernel with GhockLock patched on OpenVZ 7 (Should work on vanilla CentOS 7 too)


git clone -b branch-rh7-3.10.0-1160.129.1.vz7.226.x-ovz --single-branch --depth 1 https://USERNAME@bitbucket.org/openvz/vzkernel.git

cd vzkernel
patch -p0 kernel/rtmutex.c < /patch/CVE-2026-43499-vzkernel3.10.patch (or just overwrite rtmutex.c from my attachments)
cp config.OpenVZ .config
make olddefconfig
make -j10 bzImage
make -j10 modules
make modules_install
cp arch/x86/boot/bzImage /boot/vmlinuz-3.10.0-1160.129.1.ovz7.226.2
dracut /boot/initramfs-3.10.0-1160.129.1.ovz7.226.2.img 3.10.0-1160.129.1.ovz7.226.2
grub2-mkconfig -o /boot/grub2/grub.cfg (or if EFI then EFI path)

Thats it .. make new kernel default and reboot into kernel
best to do it on test env to see if it works

If anyone have better solution or if ive made some critical mistake i will be glad to hear and correct... perhaps i will make .rpm or some repo .. i am just lazy ATM, still waiting to see if OpenVZ team is going to do something officially before i do something on my own.... If they dont patch this then this project is really dead and migrate ASAP, but i have a feeling we will see patch soon.

Have fun!

>> dmc / dtc <<

Report message to a moderator

[Message index]
 
Read Message
Read Message
Read Message
Read Message
Read Message
Read Message
Read Message
Read Message
Read Message
Read Message
Read Message
Read Message
Read Message
Read Message
Previous Topic: Openvz7 and CVE-2026-31431 (Copy Fail) vulnerability
Next Topic: Forum auto-registration is closed
Goto Forum:
  

[ Syndicate this forum (XML) ] [ RSS ] [ PDF ]

Current Time: Mon Aug 24 10:51:50 GMT 2026

Total time taken to generate the page: 1.29686 seconds
Powered by FUDforum Powered by Virtuozzo Containers