A new sudo package with the CVE-2021-3156 fix within CloudLinux 6 extended lifecycle support has been scheduled for gradual rollout from our production repository.

Rollout slot: 4

Rolled out to: 1%

ETA for 100% rollout: February, 10

Changelog

sudo-1.8.6p3-30.cloudlinux.els6

• Fixed Heap-based buffer overflow in Sudo (CVE-2021-3156)

Update command

yum update sudo*

Immediate update (via bypass)

yum update sudo* --enablerepo=cloudlinux-rollout-4-bypass

CVE-2021-3156 description

Sudo before 1.9.5p2 has a Heap-based Buffer Overflow, allowing privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.

Kernel module kmod-lve-2.0-24 for CloudLinux 8 and CloudLinux 7 Hybrid has been scheduled for gradual rollout from our production repository.

Rollout slot: 1

Rolled out to: 0.2%

ETA for 100% rollout: February, 15

Changelog

• KMODLVE-380: enable sleep in hooks and avoid calling the hooked func
• KMODLVE-385: prevent jump out of the container's root via procfs symlinks
• KMODLVE-383: do not cpu-starve in __lve_init
• CLKRN-659: fix procfs access
• KMODLVE-377: use module_mutex when resolving names
• KMODLVE-374: remove trace_printk() calls
• KMODLVE-353: lve_enter_pid_flags() API call
• KMODLVE-373: do not kill unkillable threads in lve_enter