@@ -2,7 +2,7 @@

 Summary:       Kernel

 Name:          linux-esx

 Version:       4.4.8

-Release:       1%{?dist}

+Release:       2%{?dist}

 License:       GPLv2

 URL:           http://www.kernel.org/

 Group:         System Environment/Kernel

@@ -22,6 +22,10 @@ Patch7:        03-poweroff.patch

 Patch8:        04-quiet-boot.patch

 Patch9:        05-pv-ops.patch

 Patch10:       06-sunrpc.patch

+#fixes CVE-2016-3134

+Patch11:         netfilter-x_tables-deal-with-bogus-nextoffset-values.patch

+#fixes CVE-2016-3135

+Patch12:         netfilter-x_tables-check-for-size-overflow.patch

 BuildRequires: bc 

 BuildRequires: kbd

 BuildRequires: kmod

@@ -67,6 +71,8 @@ The Linux package contains the Linux kernel doc files

 %patch8 -p1

 %patch9 -p1

 %patch10 -p1

+%patch11 -p1

+%patch12 -p1

 %build

 make mrproper

@@ -132,6 +138,8 @@ ln -sf %{name}-%{version}-%{release}.cfg /boot/photon.cfg

 /usr/src/%{name}-headers-%{version}-%{release}

 %changelog

+*   Mon May 23 2016 Divya Thaluru <dthaluru@vmware.com> 4.4.8-2

+-   Added patches to fix CVE-2016-3134, CVE-2016-3135

 *   Fri May 13 2016 Alexey Makhalov <amakhalov@vmware.com> 4.4.8-1

 -   Update to linux-4.4.8

 -   Added net-Drivers-Vmxnet3-set-... patch

@@ -2,7 +2,7 @@

 Summary:        Kernel

 Name:           linux

 Version:    	4.4.8

-Release:    	2%{?dist}

+Release:    	3%{?dist}

 License:    	GPLv2

 URL:        	http://www.kernel.org/

 Group:        	System Environment/Kernel

@@ -18,6 +18,10 @@ Patch3:         SUNRPC-Do-not-reuse-srcport-for-TIME_WAIT-socket.patch

 Patch4:         06-sunrpc.patch

 Patch5:         vmware-log-kmsg-dump-on-panic.patch

 Patch6:         net-Driver-Vmxnet3-set-CHECKSUM_UNNECESSARY-for-IPv6-packets.patch

+#fixes CVE-2016-3134

+Patch7:		netfilter-x_tables-deal-with-bogus-nextoffset-values.patch

+#fixes CVE-2016-3135

+Patch8:		netfilter-x_tables-check-for-size-overflow.patch

 BuildRequires:  bc

 BuildRequires:  kbd

 BuildRequires:  kmod

@@ -80,6 +84,8 @@ Kernel driver for oprofile, a statistical profiler for Linux systems

 %patch4 -p1

 %patch5 -p1

 %patch6 -p1

+%patch7 -p1

+%patch8 -p1

 %build

 make mrproper

@@ -170,8 +176,10 @@ ln -sf %{name}-%{version}-%{release}.cfg /boot/photon.cfg

 /lib/modules/%{version}/kernel/arch/x86/oprofile/

 %changelog

-* 	Wed May 18 2016 Harish Udaiya Kumar <hudaiyakumar@vmware.com> 4.4.8-2

--	Enabled CONFIG_UPROBES in config as needed by ktap

+*   Mon May 23 2016 Divya Thaluru <dthaluru@vmware.com> 4.4.8-3

+-   Added patches to fix CVE-2016-3134, CVE-2016-3135

+*   Wed May 18 2016 Harish Udaiya Kumar <hudaiyakumar@vmware.com> 4.4.8-2

+-   Enabled CONFIG_UPROBES in config as needed by ktap

 *   Wed May 04 2016 Alexey Makhalov <amakhalov@vmware.com> 4.4.8-1

 -   Update to linux-4.4.8

 -   Added net-Drivers-Vmxnet3-set-... patch

new file mode 100644

@@ -0,0 +1,31 @@

+Subject:    [PATCH nf] netfilter: x_tables: check for size overflow

+From:       Florian Westphal <fw () strlen ! de>

+Date:       2016-03-10 0:56:23

+

+Ben Hawkes says:

+ integer overflow in xt_alloc_table_info, which on 32-bit systems can

+ lead to small structure allocation and a copy_from_user based heap

+ corruption.

+

+Reported-by: Ben Hawkes <hawkes@google.com>

+Signed-off-by: Florian Westphal <fw@strlen.de>

+---

+ net/netfilter/x_tables.c | 3 +++

+ 1 file changed, 3 insertions(+)

+

+diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c

+index c8a0b7d..17a9a9f 100644

+--- a/net/netfilter/x_tables.c

+@@ -659,6 +659,9 @@ struct xt_table_info *xt_alloc_table_info(unsigned int size)

+ 	struct xt_table_info *info = NULL;

+ 	size_t sz = sizeof(*info) + size;

+ 

++	if (sz < sizeof(*info))

++		return NULL;

++

+ 	/* Pedantry: prevent them from hitting BUG() in vmalloc.c --RR */

+ 	if ((SMP_ALIGN(size) >> PAGE_SHIFT) + 2 > totalram_pages)

+ 		return NULL;

+-- 

+2.4.10

new file mode 100644

@@ -0,0 +1,150 @@

+Subject:    [PATCH nf] netfilter: x_tables: deal with bogus nextoffset values

+From:       Florian Westphal <fw () strlen ! de>

+Date:       2016-03-10 0:56:02

+

+Ben Hawkes says:

+

+ In the mark_source_chains function (net/ipv4/netfilter/ip_tables.c) it

+ is possible for a user-supplied ipt_entry structure to have a large

+ next_offset field. This field is not bounds checked prior to writing a

+ counter value at the supplied offset.

+

+Problem is that xt_entry_foreach() macro stops iterating once e->next_offset

+is out of bounds, assuming this is the last entry.

+

+With malformed data thats not necessarily the case so we can

+write outside of allocated area later as we might not have walked the

+entire blob.

+

+Fix this by simplifying mark_source_chains -- it already has to check

+if nextoff is in range to catch invalid jumps, so just do the check

+when we move to a next entry as well.

+

+Signed-off-by: Florian Westphal <fw@strlen.de>

+---

+ net/ipv4/netfilter/arp_tables.c | 16 ++++++++--------

+ net/ipv4/netfilter/ip_tables.c  | 15 ++++++++-------

+ net/ipv6/netfilter/ip6_tables.c | 13 ++++++-------

+ 3 files changed, 22 insertions(+), 22 deletions(-)

+

+diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c

+index b488cac..5a0b591 100644

+--- a/net/ipv4/netfilter/arp_tables.c

+@@ -437,6 +437,10 @@ static int mark_source_chains(const struct xt_table_info *newinfo,

+ 

+ 				/* Move along one */

+ 				size = e->next_offset;

++

++				if (pos + size > newinfo->size - sizeof(*e))

++					return 0;

++

+ 				e = (struct arpt_entry *)

+ 					(entry0 + pos + size);

+ 				e->counters.pcnt = pos;

+@@ -447,14 +451,6 @@ static int mark_source_chains(const struct xt_table_info *newinfo,

+ 				if (strcmp(t->target.u.user.name,

+ 					   XT_STANDARD_TARGET) == 0 &&

+ 				    newpos >= 0) {

+-					if (newpos > newinfo->size -

+-						sizeof(struct arpt_entry)) {

+-						duprintf("mark_source_chains: "

+-							"bad verdict (%i)\n",

+-								newpos);

+-						return 0;

+-					}

+-

+ 					/* This a jump; chase it. */

+ 					duprintf("Jump rule %u -> %u\n",

+ 						 pos, newpos);

+@@ -462,6 +458,10 @@ static int mark_source_chains(const struct xt_table_info *newinfo,

+ 					/* ... this is a fallthru */

+ 					newpos = pos + e->next_offset;

+ 				}

++

++				if (newpos > newinfo->size - sizeof(*e))

++					return 0;

++

+ 				e = (struct arpt_entry *)

+ 					(entry0 + newpos);

+ 				e->counters.pcnt = pos;

+diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c

+index b99affa..ceb995f 100644

+--- a/net/ipv4/netfilter/ip_tables.c

+@@ -519,6 +519,10 @@ mark_source_chains(const struct xt_table_info *newinfo,

+ 

+ 				/* Move along one */

+ 				size = e->next_offset;

++

++				if (pos + size > newinfo->size - sizeof(*e))

++					return 0;

++

+ 				e = (struct ipt_entry *)

+ 					(entry0 + pos + size);

+ 				e->counters.pcnt = pos;

+@@ -529,13 +533,6 @@ mark_source_chains(const struct xt_table_info *newinfo,

+ 				if (strcmp(t->target.u.user.name,

+ 					   XT_STANDARD_TARGET) == 0 &&

+ 				    newpos >= 0) {

+-					if (newpos > newinfo->size -

+-						sizeof(struct ipt_entry)) {

+-						duprintf("mark_source_chains: "

+-							"bad verdict (%i)\n",

+-								newpos);

+-						return 0;

+-					}

+ 					/* This a jump; chase it. */

+ 					duprintf("Jump rule %u -> %u\n",

+ 						 pos, newpos);

+@@ -543,6 +540,10 @@ mark_source_chains(const struct xt_table_info *newinfo,

+ 					/* ... this is a fallthru */

+ 					newpos = pos + e->next_offset;

+ 				}

++

++				if (newpos > newinfo->size - sizeof(*e))

++					return 0;

++

+ 				e = (struct ipt_entry *)

+ 					(entry0 + newpos);

+ 				e->counters.pcnt = pos;

+diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c

+index 99425cf..d88a794 100644

+--- a/net/ipv6/netfilter/ip6_tables.c

+@@ -531,6 +531,8 @@ mark_source_chains(const struct xt_table_info *newinfo,

+ 

+ 				/* Move along one */

+ 				size = e->next_offset;

++				if (pos + size > newinfo->size - sizeof(*e))

++					return 0;

+ 				e = (struct ip6t_entry *)

+ 					(entry0 + pos + size);

+ 				e->counters.pcnt = pos;

+@@ -541,13 +543,6 @@ mark_source_chains(const struct xt_table_info *newinfo,

+ 				if (strcmp(t->target.u.user.name,

+ 					   XT_STANDARD_TARGET) == 0 &&

+ 				    newpos >= 0) {

+-					if (newpos > newinfo->size -

+-						sizeof(struct ip6t_entry)) {

+-						duprintf("mark_source_chains: "

+-							"bad verdict (%i)\n",

+-								newpos);

+-						return 0;

+-					}

+ 					/* This a jump; chase it. */

+ 					duprintf("Jump rule %u -> %u\n",

+ 						 pos, newpos);

+@@ -555,6 +550,10 @@ mark_source_chains(const struct xt_table_info *newinfo,

+ 					/* ... this is a fallthru */

+ 					newpos = pos + e->next_offset;

+ 				}

++

++				if (newpos > newinfo->size - sizeof(*e))

++					return 0;

++

+ 				e = (struct ip6t_entry *)

+ 					(entry0 + newpos);

+ 				e->counters.pcnt = pos;

+-- 

+2.4.10