Browse code
kernels: version update to 4.4.88
To fix CVE-2017-14340
extras:
- linux-esx: enable kprobes
Change-Id: I34b3d4c6a44e9dc87b787d9eb861620d509c7ac0
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/3880
Tested-by: gerrit-photon <photon-checkins@vmware.com>
Reviewed-by: Srivatsa S. Bhat <srivatsab@vmware.com>
Reviewed-by: Vinay Kulkarni <kulkarniv@vmware.com>
Alexey Makhalov authored on 2017/09/27 15:00:08Showing 5 changed files
- SPECS/linux-api-headers/linux-api-headers.spec
- SPECS/linux/config-esx
- SPECS/linux/linux-esx.spec
- SPECS/linux/linux.spec
- SPECS/linux/xfrm-policy-check-policy-direction-value.patch
| ... | ... |
@@ -1,6 +1,6 @@ |
| 1 | 1 |
Summary: Linux API header files |
| 2 | 2 |
Name: linux-api-headers |
| 3 |
-Version: 4.4.86 |
|
| 3 |
+Version: 4.4.88 |
|
| 4 | 4 |
Release: 1%{?dist}
|
| 5 | 5 |
License: GPLv2 |
| 6 | 6 |
URL: http://www.kernel.org/ |
| ... | ... |
@@ -8,7 +8,7 @@ Group: System Environment/Kernel |
| 8 | 8 |
Vendor: VMware, Inc. |
| 9 | 9 |
Distribution: Photon |
| 10 | 10 |
Source0: http://www.kernel.org/pub/linux/kernel/v4.x/linux-%{version}.tar.xz
|
| 11 |
-%define sha1 linux=f70a59faebdb8f5d8e865b7f9eca1e05b4044b63 |
|
| 11 |
+%define sha1 linux=40ac50fad1c01f1f40a4f93a20ea698861b35c94 |
|
| 12 | 12 |
BuildArch: noarch |
| 13 | 13 |
# From SPECS/linux and used by linux-esx only |
| 14 | 14 |
# It provides f*xattrat syscalls |
| ... | ... |
@@ -29,6 +29,8 @@ find /%{buildroot}%{_includedir} \( -name .install -o -name ..install.cmd \) -de
|
| 29 | 29 |
%defattr(-,root,root) |
| 30 | 30 |
%{_includedir}/*
|
| 31 | 31 |
%changelog |
| 32 |
+* Fri Sep 22 2017 Alexey Makhalov <amakhalov@vmware.com> 4.4.88-1 |
|
| 33 |
+- Version update |
|
| 32 | 34 |
* Mon Sep 04 2017 Alexey Makhalov <amakhalov@vmware.com> 4.4.86-1 |
| 33 | 35 |
- Version update |
| 34 | 36 |
* Wed Aug 16 2017 Alexey Makhalov <amakhalov@vmware.com> 4.4.82-2 |
| ... | ... |
@@ -1,6 +1,6 @@ |
| 1 | 1 |
# |
| 2 | 2 |
# Automatically generated file; DO NOT EDIT. |
| 3 |
-# Linux/x86 4.4.20 Kernel Configuration |
|
| 3 |
+# Linux/x86 4.4.88 Kernel Configuration |
|
| 4 | 4 |
# |
| 5 | 5 |
CONFIG_64BIT=y |
| 6 | 6 |
CONFIG_X86_64=y |
| ... | ... |
@@ -229,12 +229,14 @@ CONFIG_SYSTEM_DATA_VERIFICATION=y |
| 229 | 229 |
# CONFIG_PROFILING is not set |
| 230 | 230 |
CONFIG_HAVE_OPROFILE=y |
| 231 | 231 |
CONFIG_OPROFILE_NMI_TIMER=y |
| 232 |
-# CONFIG_KPROBES is not set |
|
| 232 |
+CONFIG_KPROBES=y |
|
| 233 | 233 |
# CONFIG_JUMP_LABEL is not set |
| 234 |
+CONFIG_OPTPROBES=y |
|
| 234 | 235 |
# CONFIG_UPROBES is not set |
| 235 | 236 |
# CONFIG_HAVE_64BIT_ALIGNED_ACCESS is not set |
| 236 | 237 |
CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y |
| 237 | 238 |
CONFIG_ARCH_USE_BUILTIN_BSWAP=y |
| 239 |
+CONFIG_KRETPROBES=y |
|
| 238 | 240 |
CONFIG_HAVE_IOREMAP_PROT=y |
| 239 | 241 |
CONFIG_HAVE_KPROBES=y |
| 240 | 242 |
CONFIG_HAVE_KRETPROBES=y |
| ... | ... |
@@ -1111,7 +1113,6 @@ CONFIG_OPENVSWITCH_VXLAN=m |
| 1111 | 1111 |
CONFIG_OPENVSWITCH_GENEVE=m |
| 1112 | 1112 |
CONFIG_VSOCKETS=y |
| 1113 | 1113 |
CONFIG_VMWARE_VMCI_VSOCKETS=y |
| 1114 |
-# CONFIG_NETLINK_MMAP is not set |
|
| 1115 | 1114 |
# CONFIG_NETLINK_DIAG is not set |
| 1116 | 1115 |
CONFIG_MPLS=y |
| 1117 | 1116 |
CONFIG_NET_MPLS_GSO=m |
| ... | ... |
@@ -1133,6 +1134,7 @@ CONFIG_NET_FLOW_LIMIT=y |
| 1133 | 1133 |
# Network testing |
| 1134 | 1134 |
# |
| 1135 | 1135 |
# CONFIG_NET_PKTGEN is not set |
| 1136 |
+# CONFIG_NET_TCPPROBE is not set |
|
| 1136 | 1137 |
# CONFIG_HAMRADIO is not set |
| 1137 | 1138 |
# CONFIG_CAN is not set |
| 1138 | 1139 |
# CONFIG_IRDA is not set |
| ... | ... |
@@ -2845,6 +2847,7 @@ CONFIG_TRACING_SUPPORT=y |
| 2845 | 2845 |
# |
| 2846 | 2846 |
# CONFIG_LKDTM is not set |
| 2847 | 2847 |
# CONFIG_TEST_LIST_SORT is not set |
| 2848 |
+# CONFIG_KPROBES_SANITY_TEST is not set |
|
| 2848 | 2849 |
# CONFIG_BACKTRACE_SELF_TEST is not set |
| 2849 | 2850 |
# CONFIG_RBTREE_TEST is not set |
| 2850 | 2851 |
# CONFIG_INTERVAL_TREE_TEST is not set |
| ... | ... |
@@ -2884,6 +2887,7 @@ CONFIG_DOUBLEFAULT=y |
| 2884 | 2884 |
# CONFIG_DEBUG_TLBFLUSH is not set |
| 2885 | 2885 |
# CONFIG_IOMMU_STRESS is not set |
| 2886 | 2886 |
CONFIG_HAVE_MMIOTRACE_SUPPORT=y |
| 2887 |
+# CONFIG_X86_DECODER_SELFTEST is not set |
|
| 2887 | 2888 |
CONFIG_IO_DELAY_TYPE_0X80=0 |
| 2888 | 2889 |
CONFIG_IO_DELAY_TYPE_0XED=1 |
| 2889 | 2890 |
CONFIG_IO_DELAY_TYPE_UDELAY=2 |
| ... | ... |
@@ -1,7 +1,7 @@ |
| 1 | 1 |
%global security_hardening none |
| 2 | 2 |
Summary: Kernel |
| 3 | 3 |
Name: linux-esx |
| 4 |
-Version: 4.4.86 |
|
| 4 |
+Version: 4.4.88 |
|
| 5 | 5 |
Release: 1%{?dist}
|
| 6 | 6 |
License: GPLv2 |
| 7 | 7 |
URL: http://www.kernel.org/ |
| ... | ... |
@@ -9,7 +9,7 @@ Group: System Environment/Kernel |
| 9 | 9 |
Vendor: VMware, Inc. |
| 10 | 10 |
Distribution: Photon |
| 11 | 11 |
Source0: http://www.kernel.org/pub/linux/kernel/v4.x/linux-%{version}.tar.xz
|
| 12 |
-%define sha1 linux=f70a59faebdb8f5d8e865b7f9eca1e05b4044b63 |
|
| 12 |
+%define sha1 linux=40ac50fad1c01f1f40a4f93a20ea698861b35c94 |
|
| 13 | 13 |
Source1: config-esx |
| 14 | 14 |
Patch0: double-tcp_mem-limits.patch |
| 15 | 15 |
Patch1: linux-4.4-sysctl-sched_weighted_cpuload_uses_rla.patch |
| ... | ... |
@@ -36,8 +36,6 @@ Patch21: vmci-1.1.5.0-doorbell-create-and-destroy-fixes.patch |
| 36 | 36 |
Patch22: net-9p-vsock.patch |
| 37 | 37 |
Patch23: p9fs_dir_readdir-offset-support.patch |
| 38 | 38 |
Patch24: Implement-the-f-xattrat-family-of-functions.patch |
| 39 |
-# Fix CVE-2017-11600 |
|
| 40 |
-Patch25: xfrm-policy-check-policy-direction-value.patch |
|
| 41 | 39 |
|
| 42 | 40 |
BuildRequires: bc |
| 43 | 41 |
BuildRequires: kbd |
| ... | ... |
@@ -99,7 +97,6 @@ The Linux package contains the Linux kernel doc files |
| 99 | 99 |
%patch22 -p1 |
| 100 | 100 |
%patch23 -p1 |
| 101 | 101 |
%patch24 -p1 |
| 102 |
-%patch25 -p1 |
|
| 103 | 102 |
|
| 104 | 103 |
%build |
| 105 | 104 |
# patch vmw_balloon driver |
| ... | ... |
@@ -188,6 +185,8 @@ ln -sf linux-%{uname_r}.cfg /boot/photon.cfg
|
| 188 | 188 |
/usr/src/linux-headers-%{uname_r}
|
| 189 | 189 |
|
| 190 | 190 |
%changelog |
| 191 |
+* Fri Sep 22 2017 Alexey Makhalov <amakhalov@vmware.com> 4.4.88-1 |
|
| 192 |
+- Enable kprobes |
|
| 191 | 193 |
* Mon Sep 04 2017 Alexey Makhalov <amakhalov@vmware.com> 4.4.86-1 |
| 192 | 194 |
- Fix CVE-2017-11600 |
| 193 | 195 |
* Wed Aug 16 2017 Alexey Makhalov <amakhalov@vmware.com> 4.4.82-2 |
| ... | ... |
@@ -1,7 +1,7 @@ |
| 1 | 1 |
%global security_hardening none |
| 2 | 2 |
Summary: Kernel |
| 3 | 3 |
Name: linux |
| 4 |
-Version: 4.4.86 |
|
| 4 |
+Version: 4.4.88 |
|
| 5 | 5 |
Release: 1%{?dist}
|
| 6 | 6 |
License: GPLv2 |
| 7 | 7 |
URL: http://www.kernel.org/ |
| ... | ... |
@@ -9,7 +9,7 @@ Group: System Environment/Kernel |
| 9 | 9 |
Vendor: VMware, Inc. |
| 10 | 10 |
Distribution: Photon |
| 11 | 11 |
Source0: http://www.kernel.org/pub/linux/kernel/v4.x/%{name}-%{version}.tar.xz
|
| 12 |
-%define sha1 linux=f70a59faebdb8f5d8e865b7f9eca1e05b4044b63 |
|
| 12 |
+%define sha1 linux=40ac50fad1c01f1f40a4f93a20ea698861b35c94 |
|
| 13 | 13 |
Source1: config |
| 14 | 14 |
%define ena_version 1.1.3 |
| 15 | 15 |
Source2: https://github.com/amzn/amzn-drivers/archive/ena_linux_1.1.3.tar.gz |
| ... | ... |
@@ -38,8 +38,6 @@ Patch17: 0001-Revert-crypto-testmgr-Disable-fips-allowed-for-authe.patch |
| 38 | 38 |
Patch18: 0002-allow-also-ecb-cipher_null.patch |
| 39 | 39 |
# Fix CVE-2017-10911 |
| 40 | 40 |
Patch19: xen-blkback-dont-leak-stack-data-via-response-ring.patch |
| 41 |
-# Fix CVE-2017-11600 |
|
| 42 |
-Patch20: xfrm-policy-check-policy-direction-value.patch |
|
| 43 | 41 |
|
| 44 | 42 |
BuildRequires: bc |
| 45 | 43 |
BuildRequires: kbd |
| ... | ... |
@@ -130,7 +128,6 @@ This package contains the 'perf' performance analysis tools for Linux kernel. |
| 130 | 130 |
%patch17 -p1 |
| 131 | 131 |
%patch18 -p1 |
| 132 | 132 |
%patch19 -p1 |
| 133 |
-%patch20 -p1 |
|
| 134 | 133 |
|
| 135 | 134 |
%build |
| 136 | 135 |
make mrproper |
| ... | ... |
@@ -283,6 +280,8 @@ ln -sf %{name}-%{uname_r}.cfg /boot/photon.cfg
|
| 283 | 283 |
/usr/share/perf-core |
| 284 | 284 |
|
| 285 | 285 |
%changelog |
| 286 |
+* Fri Sep 22 2017 Alexey Makhalov <amakhalov@vmware.com> 4.4.88-1 |
|
| 287 |
+- Version update |
|
| 286 | 288 |
* Mon Sep 04 2017 Alexey Makhalov <amakhalov@vmware.com> 4.4.86-1 |
| 287 | 289 |
- Fix CVE-2017-11600 |
| 288 | 290 |
* Thu Aug 17 2017 Alexey Makhalov <amakhalov@vmware.com> 4.4.82-2 |
| 289 | 291 |
deleted file mode 100644 |
| ... | ... |
@@ -1,44 +0,0 @@ |
| 1 |
-From 7bab09631c2a303f87a7eb7e3d69e888673b9b7e Mon Sep 17 00:00:00 2001 |
|
| 2 |
-From: Vladis Dronov <vdronov@redhat.com> |
|
| 3 |
-Date: Wed, 2 Aug 2017 19:50:14 +0200 |
|
| 4 |
-Subject: xfrm: policy: check policy direction value |
|
| 5 |
- |
|
| 6 |
-The 'dir' parameter in xfrm_migrate() is a user-controlled byte which is used |
|
| 7 |
-as an array index. This can lead to an out-of-bound access, kernel lockup and |
|
| 8 |
-DoS. Add a check for the 'dir' value. |
|
| 9 |
- |
|
| 10 |
-This fixes CVE-2017-11600. |
|
| 11 |
- |
|
| 12 |
-References: https://bugzilla.redhat.com/show_bug.cgi?id=1474928 |
|
| 13 |
-Fixes: 80c9abaabf42 ("[XFRM]: Extension for dynamic update of endpoint address(es)")
|
|
| 14 |
-Cc: <stable@vger.kernel.org> # v2.6.21-rc1 |
|
| 15 |
-Reported-by: "bo Zhang" <zhangbo5891001@gmail.com> |
|
| 16 |
-Signed-off-by: Vladis Dronov <vdronov@redhat.com> |
|
| 17 |
-Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> |
|
| 18 |
- net/xfrm/xfrm_policy.c | 6 ++++++ |
|
| 19 |
- 1 file changed, 6 insertions(+) |
|
| 20 |
- |
|
| 21 |
-diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c |
|
| 22 |
-index ff61d85..6f5a0dad 100644 |
|
| 23 |
-+++ b/net/xfrm/xfrm_policy.c |
|
| 24 |
-@@ -3308,9 +3308,15 @@ int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, |
|
| 25 |
- struct xfrm_state *x_new[XFRM_MAX_DEPTH]; |
|
| 26 |
- struct xfrm_migrate *mp; |
|
| 27 |
- |
|
| 28 |
-+ /* Stage 0 - sanity checks */ |
|
| 29 |
- if ((err = xfrm_migrate_check(m, num_migrate)) < 0) |
|
| 30 |
- goto out; |
|
| 31 |
- |
|
| 32 |
-+ if (dir >= XFRM_POLICY_MAX) {
|
|
| 33 |
-+ err = -EINVAL; |
|
| 34 |
-+ goto out; |
|
| 35 |
-+ } |
|
| 36 |
-+ |
|
| 37 |
- /* Stage 1 - find policy */ |
|
| 38 |
- if ((pol = xfrm_migrate_policy_find(sel, dir, type, net)) == NULL) {
|
|
| 39 |
- err = -ENOENT; |
|
| 40 |
-cgit v1.1 |
|
| 41 |
- |