Description
The Linux 2.4 kernel patch in kernel-patch-vserver before 1.9.5.5 and 2.x before 2.3 for Debian GNU/Linux does not correctly set the "chroot barrier" with util-vserver, which allows attackers to access files on the host system that are outside of the vserver.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | kernel-patch-vserver | 1.9.5.4 | DSA-1011-1 |
| Debian 3.1 | util-vserver | 0.30.204-5sarge3 | DSA-1011-1 |
Advisories 1
- DSA-1011-1 kernel-patch-server, util-vserver - missing attribute support Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-1011 vendor-advisory
- debian-vserver-chrootbarrier-gain-access(25406) vdb-entry
- 19339 third-party-advisory