OpenVZ Forum


Home » General » Support » CVE-2026-72389 (Bridge STP UAF) OpenVZ 7 kernel update planned?
Re: CVE-2026-72389 (Bridge STP UAF) OpenVZ 7 kernel update planned? [message #53906 is a reply to message #53905] Fri, 11 September 2026 12:53 Go to previous messageGo to previous message
wiredincode is currently offline  wiredincode
Messages: 1
Registered: September 2026
Junior Member
It appears that OpenVZ would be vulnerable to this. I didn't even know about the "Factory" repo, so glad you mentioned this as I made my own patch for Ghostlock.

Note current factory repo version is 3.10.0-1160.129.1.vz7.226.3, not .224.4.



From my initial investigation, it appears you can mitigate this by disabling the Bridge feature on your containers:

[root@chivz23-new ~]# vzctl exec 7570 'ip link add testbr type bridge && echo "EXPOSED" || echo "blocked"'
EXPOSED

[root@chivz23-new ~]# vzctl exec 7570 ip link del testbr

[root@chivz23-new ~]# vzctl set  7570  --features bridge:off --save  --setmode restart
Unable to set features for the running Container
Restart the Container
Stopping the Container ...
[ ... ]
Container start in progress...
Saved parameters for Container 7570

[root@chivz23-new ~]# vzctl exec 7570 'ip link add testbr type bridge && echo "EXPOSED" || echo "blocked"'
RTNETLINK answers: Permission denied
blocked

I can't make any guarantees but there is some logic to the fact that if you can't open a bridge, you can't mess with the timers, so I am applying this mitigation to my containers while I test my kernel patch.

Report message to a moderator

[Message index]
 
Read Message
Read Message
Read Message
Previous Topic: Urgent: GhostLock (CVE-2026-43499) on OpenVZ 7 Where is the patch for WebPros / SolusVM users?
Next Topic: Forum auto-registration is closed
Goto Forum:
  

[ Syndicate this forum (XML) ] [ RSS ] [ PDF ]

Current Time: Sun Sep 13 13:51:17 GMT 2026

Total time taken to generate the page: 0.50151 seconds
Powered by FUDforum Powered by Virtuozzo Containers