Description
Virtual Private Server (Vserver) 2.0.x before 2.0.2-rc18 and 2.1.x before 2.1.1-rc18 provides certain context capabilities (ccaps) that allow local guest users to perform operations that were only intended to be allowed by the guest-root.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | kernel-patch-vserver | 1.9.5.6 | DSA-1060-1 |
Advisories 1
- DSA-1060-1 kernel-patch-server - programming error Debian Security (DSA / DLA) · Mar 9, 2026
References
- [Vserver] 20060428 [SECURITY] ccaps not limited to root inside a guest mailing-list
- 17842 vdb-entry
- DSA-1060 vendor-advisory
- ADV-2006-1661 vdb-entry
- 19961 third-party-advisory
- 20206 third-party-advisory
- linux-vserver-ccaps-privilege-escalation(26285) vdb-entry
- http://dev.croup.de/proj/gentoo-vps/browser/vserver-sources/2.0.1-r4/4915_vs2.0.1-vxcapable-fix.patch