@@ -1,6 +1,6 @@

 Summary:	Linux API header files

 Name:		linux-api-headers

-Version:	4.9.71

+Version:	4.9.74

 Release:	1%{?dist}

 License:	GPLv2

 URL:		http://www.kernel.org/

@@ -8,7 +8,7 @@ Group:		System Environment/Kernel

 Vendor:		VMware, Inc.

 Distribution: Photon

 Source0:        http://www.kernel.org/pub/linux/kernel/v4.x/linux-%{version}.tar.xz

-%define sha1 linux=837883b228489c9717bce49e021080d94921460b

+%define sha1 linux=b9054174240bc452a9596e59921c93e903fa3d60

 BuildArch:	noarch

 %description

 The Linux API Headers expose the kernel's API for use by Glibc.

@@ -25,6 +25,8 @@ find /%{buildroot}%{_includedir} \( -name .install -o -name ..install.cmd \) -de

 %defattr(-,root,root)

 %{_includedir}/*

 %changelog

+*   Tue Jan 02 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.9.74-1

+-   Version update

 *   Thu Dec 21 2017 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.9.71-1

 -   Version update

 *   Mon Dec 04 2017 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.9.66-1

new file mode 100644

@@ -0,0 +1,37 @@

+commit 69c64866ce072dea1d1e59a0d61e0f66c0dffb76

+Author: Mohamed Ghannam <simo.ghannam@gmail.com>

+Date:   Tue Dec 5 20:58:35 2017 +0000

+

+    dccp: CVE-2017-8824: use-after-free in DCCP code

+

+    Whenever the sock object is in DCCP_CLOSED state,

+    dccp_disconnect() must free dccps_hc_tx_ccid and

+    dccps_hc_rx_ccid and set to NULL.

+

+    Signed-off-by: Mohamed Ghannam <simo.ghannam@gmail.com>

+    Reviewed-by: Eric Dumazet <edumazet@google.com>

+    Signed-off-by: David S. Miller <davem@davemloft.net>

+

+diff --git a/net/dccp/proto.c b/net/dccp/proto.c

+index b68168f..9d43c1f 100644

+--- a/net/dccp/proto.c

+@@ -259,6 +259,7 @@ int dccp_disconnect(struct sock *sk, int flags)

+ {

+ 	struct inet_connection_sock *icsk = inet_csk(sk);

+ 	struct inet_sock *inet = inet_sk(sk);

++	struct dccp_sock *dp = dccp_sk(sk);

+ 	int err = 0;

+ 	const int old_state = sk->sk_state;

+ 

+@@ -278,6 +279,10 @@ int dccp_disconnect(struct sock *sk, int flags)

+ 		sk->sk_err = ECONNRESET;

+ 

+ 	dccp_clear_xmit_timers(sk);

++	ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk);

++	ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk);

++	dp->dccps_hc_rx_ccid = NULL;

++	dp->dccps_hc_tx_ccid = NULL;

+ 

+ 	__skb_queue_purge(&sk->sk_receive_queue);

+ 	__skb_queue_purge(&sk->sk_write_queue);

@@ -1,7 +1,7 @@

 %global security_hardening none

 Summary:        Kernel

 Name:           linux-esx

-Version:        4.9.71

+Version:        4.9.74

 Release:        1%{?dist}

 License:        GPLv2

 URL:            http://www.kernel.org/

@@ -9,7 +9,7 @@ Group:          System Environment/Kernel

 Vendor:         VMware, Inc.

 Distribution:   Photon

 Source0:        http://www.kernel.org/pub/linux/kernel/v4.x/linux-%{version}.tar.xz

-%define sha1 linux=837883b228489c9717bce49e021080d94921460b

+%define sha1 linux=b9054174240bc452a9596e59921c93e903fa3d60

 Source1:        config-esx

 Source2:        initramfs.trigger

 # common

@@ -40,8 +40,13 @@ Patch22:        add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by-default.pat

 Patch23:        ACPICA-Namespace-fix-operand-cache-leak.patch

 # Fix CVE-2017-1000252

 Patch24:        kvm-dont-accept-wrong-gsi-values.patch

-

-Patch25:       init-do_mounts-recreate-dev-root.patch

+Patch25:        init-do_mounts-recreate-dev-root.patch

+# Fix CVE-2017-8824

+Patch26:        dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch

+# Fix CVE-2017-17448

+Patch27:        netfilter-nfnetlink_cthelper-Add-missing-permission-checks.patch

+# Fix CVE-2017-17450

+Patch28:        netfilter-xt_osf-Add-missing-permission-checks.patch

 BuildRequires: bc

 BuildRequires: kbd

@@ -104,6 +109,9 @@ The Linux package contains the Linux kernel doc files

 %patch23 -p1

 %patch24 -p1

 %patch25 -p1

+%patch26 -p1

+%patch27 -p1

+%patch28 -p1

 %build

 # patch vmw_balloon driver

@@ -200,6 +208,9 @@ ln -sf linux-%{uname_r}.cfg /boot/photon.cfg

 /usr/src/linux-headers-%{uname_r}

 %changelog

+*   Tue Jan 02 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.9.74-1

+-   Version update

+-   Add patches to fix CVE-2017-8824, CVE-2017-17448 and CVE-2017-17450.

 *   Thu Dec 21 2017 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.9.71-1

 -   Version update

 *   Mon Dec 19 2017 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.9.66-2

@@ -1,7 +1,7 @@

 %global security_hardening none

 Summary:        Kernel

 Name:           linux-secure

-Version:        4.9.71

+Version:        4.9.74

 Release:        1%{?kat_build:.%kat_build}%{?dist}

 License:        GPLv2

 URL:            http://www.kernel.org/

@@ -9,7 +9,7 @@ Group:          System Environment/Kernel

 Vendor:         VMware, Inc.

 Distribution:   Photon

 Source0:        http://www.kernel.org/pub/linux/kernel/v4.x/linux-%{version}.tar.xz

-%define sha1 linux=837883b228489c9717bce49e021080d94921460b

+%define sha1 linux=b9054174240bc452a9596e59921c93e903fa3d60

 Source1:        config-secure

 Source2:        aufs4.9.tar.gz

 %define sha1 aufs=ebe716ce4b638a3772c7cd3161abbfe11d584906

@@ -50,6 +50,13 @@ Patch29:        add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by-default.pat

 Patch30:        ACPICA-Namespace-fix-operand-cache-leak.patch

 # Fix CVE-2017-1000252

 Patch31:        kvm-dont-accept-wrong-gsi-values.patch

+# Fix CVE-2017-8824

+Patch32:        dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch

+# Fix CVE-2017-17448

+Patch33:        netfilter-nfnetlink_cthelper-Add-missing-permission-checks.patch

+# Fix CVE-2017-17450

+Patch34:        netfilter-xt_osf-Add-missing-permission-checks.patch

+

 # NSX requirements (should be removed)

 Patch99:        LKCM.patch

@@ -158,6 +165,9 @@ EOF

 %patch29 -p1

 %patch30 -p1

 %patch31 -p1

+%patch32 -p1

+%patch33 -p1

+%patch34 -p1

 pushd ..

 %patch99 -p0

@@ -284,6 +294,9 @@ ln -sf linux-%{uname_r}.cfg /boot/photon.cfg

 /usr/src/linux-headers-%{uname_r}

 %changelog

+*   Tue Jan 02 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.9.74-1

+-   Version update

+-   Add patches to fix CVE-2017-8824, CVE-2017-17448 and CVE-2017-17450.

 *   Thu Dec 21 2017 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.9.71-1

 -   Version update

 *   Mon Dec 04 2017 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.9.66-1

@@ -1,7 +1,7 @@

 %global security_hardening none

 Summary:        Kernel

 Name:           linux

-Version:        4.9.71

+Version:        4.9.74

 Release:        1%{?kat_build:.%kat_build}%{?dist}

 License:    	GPLv2

 URL:        	http://www.kernel.org/

@@ -9,7 +9,7 @@ Group:        	System Environment/Kernel

 Vendor:         VMware, Inc.

 Distribution: 	Photon

 Source0:        http://www.kernel.org/pub/linux/kernel/v4.x/linux-%{version}.tar.xz

-%define sha1 linux=837883b228489c9717bce49e021080d94921460b

+%define sha1 linux=b9054174240bc452a9596e59921c93e903fa3d60

 Source1:	config

 Source2:	initramfs.trigger

 %define ena_version 1.1.3

@@ -47,6 +47,12 @@ Patch26:        add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by-default.pat

 Patch27:        ACPICA-Namespace-fix-operand-cache-leak.patch

 # Fix CVE-2017-1000252

 Patch28:        kvm-dont-accept-wrong-gsi-values.patch

+# Fix CVE-2017-8824

+Patch29:        dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch

+# Fix CVE-2017-17448

+Patch30:        netfilter-nfnetlink_cthelper-Add-missing-permission-checks.patch

+# Fix CVE-2017-17450

+Patch31:        netfilter-xt_osf-Add-missing-permission-checks.patch

 %if 0%{?kat_build:1}

 Patch1000:	%{kat_build}.patch

@@ -146,6 +152,10 @@ This package contains the 'perf' performance analysis tools for Linux kernel.

 %patch26 -p1

 %patch27 -p1

 %patch28 -p1

+%patch29 -p1

+%patch30 -p1

+%patch31 -p1

+

 %if 0%{?kat_build:1}

 %patch1000 -p1

 %endif

@@ -312,6 +322,9 @@ ln -sf %{name}-%{uname_r}.cfg /boot/photon.cfg

 /usr/share/doc/*

 %changelog

+*   Tue Jan 02 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.9.74-1

+-   Version update

+-   Add patches to fix CVE-2017-8824, CVE-2017-17448 and CVE-2017-17450.

 *   Thu Dec 21 2017 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.9.71-1

 -   Version update

 *   Tue Dec 05 2017 Alexey Makhalov <amakhalov@vmware.com> 4.9.66-2

new file mode 100644

@@ -0,0 +1,73 @@

+commit 4b380c42f7d00a395feede754f0bc2292eebe6e5

+Author: Kevin Cernekee <cernekee@chromium.org>

+Date:   Sun Dec 3 12:12:45 2017 -0800

+

+    netfilter: nfnetlink_cthelper: Add missing permission checks

+    

+    The capability check in nfnetlink_rcv() verifies that the caller

+    has CAP_NET_ADMIN in the namespace that "owns" the netlink socket.

+    However, nfnl_cthelper_list is shared by all net namespaces on the

+    system.  An unprivileged user can create user and net namespaces

+    in which he holds CAP_NET_ADMIN to bypass the netlink_net_capable()

+    check:

+    

+        $ nfct helper list

+        nfct v1.4.4: netlink error: Operation not permitted

+        $ vpnns -- nfct helper list

+        {

+                .name = ftp,

+                .queuenum = 0,

+                .l3protonum = 2,

+                .l4protonum = 6,

+                .priv_data_len = 24,

+                .status = enabled,

+        };

+    

+    Add capable() checks in nfnetlink_cthelper, as this is cleaner than

+    trying to generalize the solution.

+    

+    Signed-off-by: Kevin Cernekee <cernekee@chromium.org>

+    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

+

+diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c

+index 41628b3..d33ce6d 100644

+--- a/net/netfilter/nfnetlink_cthelper.c

+@@ -17,6 +17,7 @@

+ #include <linux/types.h>

+ #include <linux/list.h>

+ #include <linux/errno.h>

++#include <linux/capability.h>

+ #include <net/netlink.h>

+ #include <net/sock.h>

+ 

+@@ -407,6 +408,9 @@ static int nfnl_cthelper_new(struct net *net, struct sock *nfnl,

+ 	struct nfnl_cthelper *nlcth;

+ 	int ret = 0;

+ 

++	if (!capable(CAP_NET_ADMIN))

++		return -EPERM;

++

+ 	if (!tb[NFCTH_NAME] || !tb[NFCTH_TUPLE])

+ 		return -EINVAL;

+ 

+@@ -611,6 +615,9 @@ static int nfnl_cthelper_get(struct net *net, struct sock *nfnl,

+ 	struct nfnl_cthelper *nlcth;

+ 	bool tuple_set = false;

+ 

++	if (!capable(CAP_NET_ADMIN))

++		return -EPERM;

++

+ 	if (nlh->nlmsg_flags & NLM_F_DUMP) {

+ 		struct netlink_dump_control c = {

+ 			.dump = nfnl_cthelper_dump_table,

+@@ -678,6 +685,9 @@ static int nfnl_cthelper_del(struct net *net, struct sock *nfnl,

+ 	struct nfnl_cthelper *nlcth, *n;

+ 	int j = 0, ret;

+ 

++	if (!capable(CAP_NET_ADMIN))

++		return -EPERM;

++

+ 	if (tb[NFCTH_NAME])

+ 		helper_name = nla_data(tb[NFCTH_NAME]);

+ 

new file mode 100644

@@ -0,0 +1,55 @@

+commit 916a27901de01446bcf57ecca4783f6cff493309

+Author: Kevin Cernekee <cernekee@chromium.org>

+Date:   Tue Dec 5 15:42:41 2017 -0800

+

+    netfilter: xt_osf: Add missing permission checks

+    

+    The capability check in nfnetlink_rcv() verifies that the caller

+    has CAP_NET_ADMIN in the namespace that "owns" the netlink socket.

+    However, xt_osf_fingers is shared by all net namespaces on the

+    system.  An unprivileged user can create user and net namespaces

+    in which he holds CAP_NET_ADMIN to bypass the netlink_net_capable()

+    check:

+    

+        vpnns -- nfnl_osf -f /tmp/pf.os

+    

+        vpnns -- nfnl_osf -f /tmp/pf.os -d

+    

+    These non-root operations successfully modify the systemwide OS

+    fingerprint list.  Add new capable() checks so that they can't.

+    

+    Signed-off-by: Kevin Cernekee <cernekee@chromium.org>

+    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

+

+diff --git a/net/netfilter/xt_osf.c b/net/netfilter/xt_osf.c

+index 36e14b1..a34f314 100644

+--- a/net/netfilter/xt_osf.c

+@@ -19,6 +19,7 @@

+ #include <linux/module.h>

+ #include <linux/kernel.h>

+ 

++#include <linux/capability.h>

+ #include <linux/if.h>

+ #include <linux/inetdevice.h>

+ #include <linux/ip.h>

+@@ -70,6 +71,9 @@ static int xt_osf_add_callback(struct net *net, struct sock *ctnl,

+ 	struct xt_osf_finger *kf = NULL, *sf;

+ 	int err = 0;

+ 

++	if (!capable(CAP_NET_ADMIN))

++		return -EPERM;

++

+ 	if (!osf_attrs[OSF_ATTR_FINGER])

+ 		return -EINVAL;

+ 

+@@ -115,6 +119,9 @@ static int xt_osf_remove_callback(struct net *net, struct sock *ctnl,

+ 	struct xt_osf_finger *sf;

+ 	int err = -ENOENT;

+ 

++	if (!capable(CAP_NET_ADMIN))

++		return -EPERM;

++

+ 	if (!osf_attrs[OSF_ATTR_FINGER])

+ 		return -EINVAL;

+