@@ -1,6 +1,6 @@

 Summary:	Linux API header files

 Name:		linux-api-headers

-Version:	4.4.106

+Version:	4.4.109

 Release:	1%{?dist}

 License:	GPLv2

 URL:		http://www.kernel.org/

@@ -8,7 +8,7 @@ Group:		System Environment/Kernel

 Vendor:		VMware, Inc.

 Distribution: Photon

 Source0:    	http://www.kernel.org/pub/linux/kernel/v4.x/linux-%{version}.tar.xz

-%define sha1 linux=a40a7f291d85f9373f024946faa8c7dcb6dc7fdb

+%define sha1 linux=bcc074736b9ba1801d04371e0a9a4bfd8a5a2967

 BuildArch:	noarch

 # From SPECS/linux and used by linux-esx only

 # It provides f*xattrat syscalls

@@ -29,6 +29,8 @@ find /%{buildroot}%{_includedir} \( -name .install -o -name ..install.cmd \) -de

 %defattr(-,root,root)

 %{_includedir}/*

 %changelog

+*   Tue Jan 02 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.4.109-1

+-   Version update

 *   Tue Dec 19 2017 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.4.106-1

 -   Version update

 *   Fri Dec 08 2017 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.4.104-1

new file mode 100644

@@ -0,0 +1,37 @@

+commit 69c64866ce072dea1d1e59a0d61e0f66c0dffb76

+Author: Mohamed Ghannam <simo.ghannam@gmail.com>

+Date:   Tue Dec 5 20:58:35 2017 +0000

+

+    dccp: CVE-2017-8824: use-after-free in DCCP code

+

+    Whenever the sock object is in DCCP_CLOSED state,

+    dccp_disconnect() must free dccps_hc_tx_ccid and

+    dccps_hc_rx_ccid and set to NULL.

+

+    Signed-off-by: Mohamed Ghannam <simo.ghannam@gmail.com>

+    Reviewed-by: Eric Dumazet <edumazet@google.com>

+    Signed-off-by: David S. Miller <davem@davemloft.net>

+

+diff --git a/net/dccp/proto.c b/net/dccp/proto.c

+index b68168f..9d43c1f 100644

+--- a/net/dccp/proto.c

+@@ -259,6 +259,7 @@ int dccp_disconnect(struct sock *sk, int flags)

+ {

+ 	struct inet_connection_sock *icsk = inet_csk(sk);

+ 	struct inet_sock *inet = inet_sk(sk);

++	struct dccp_sock *dp = dccp_sk(sk);

+ 	int err = 0;

+ 	const int old_state = sk->sk_state;

+ 

+@@ -278,6 +279,10 @@ int dccp_disconnect(struct sock *sk, int flags)

+ 		sk->sk_err = ECONNRESET;

+ 

+ 	dccp_clear_xmit_timers(sk);

++	ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk);

++	ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk);

++	dp->dccps_hc_rx_ccid = NULL;

++	dp->dccps_hc_tx_ccid = NULL;

+ 

+ 	__skb_queue_purge(&sk->sk_receive_queue);

+ 	__skb_queue_purge(&sk->sk_write_queue);

@@ -1,7 +1,7 @@

 %global security_hardening none

 Summary:       Kernel

 Name:          linux-esx

-Version:       4.4.106

+Version:       4.4.109

 Release:       1%{?dist}

 License:       GPLv2

 URL:           http://www.kernel.org/

@@ -9,7 +9,7 @@ Group:         System Environment/Kernel

 Vendor:        VMware, Inc.

 Distribution:  Photon

 Source0:       http://www.kernel.org/pub/linux/kernel/v4.x/linux-%{version}.tar.xz

-%define sha1 linux=a40a7f291d85f9373f024946faa8c7dcb6dc7fdb

+%define sha1 linux=bcc074736b9ba1801d04371e0a9a4bfd8a5a2967

 Source1:       config-esx

 Patch0:        double-tcp_mem-limits.patch

 Patch1:        linux-4.4-sysctl-sched_weighted_cpuload_uses_rla.patch

@@ -37,8 +37,14 @@ Patch22:       net-9p-vsock.patch

 Patch23:       p9fs_dir_readdir-offset-support.patch

 Patch24:       Implement-the-f-xattrat-family-of-functions.patch

 # Fix CVE-2017-11472

-Patch25:        ACPICA-Namespace-fix-operand-cache-leak.patch

+Patch25:       ACPICA-Namespace-fix-operand-cache-leak.patch

 Patch26:       init-do_mounts-recreate-dev-root.patch

+# Fix CVE-2017-8824

+Patch27:       dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch

+# Fix CVE-2017-17448

+Patch28:       netfilter-nfnetlink_cthelper-Add-missing-permission-checks.patch

+# Fix CVE-2017-17450

+Patch29:       netfilter-xt_osf-Add-missing-permission-checks.patch

 BuildRequires: bc

 BuildRequires: kbd

@@ -102,6 +108,9 @@ The Linux package contains the Linux kernel doc files

 %patch24 -p1

 %patch25 -p1

 %patch26 -p1

+%patch27 -p1

+%patch28 -p1

+%patch29 -p1

 %build

 # patch vmw_balloon driver

@@ -190,6 +199,9 @@ ln -sf linux-%{uname_r}.cfg /boot/photon.cfg

 /usr/src/linux-headers-%{uname_r}

 %changelog

+*   Tue Jan 02 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.4.109-1

+-   Version update

+-   Add patches to fix CVE-2017-8824, CVE-2017-17448 and CVE-2017-17450.

 *   Tue Dec 19 2017 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.4.106-1

 -   Version update

 *   Fri Dec 08 2017 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.4.104-1

@@ -1,7 +1,7 @@

 %global security_hardening none

 Summary:        Kernel

 Name:           linux

-Version:    	4.4.106

+Version:    	4.4.109

 Release:        1%{?kat_build:.%kat_build}%{?dist}

 License:    	GPLv2

 URL:        	http://www.kernel.org/

@@ -9,7 +9,7 @@ Group:        	System Environment/Kernel

 Vendor:         VMware, Inc.

 Distribution: 	Photon

 Source0:    	http://www.kernel.org/pub/linux/kernel/v4.x/%{name}-%{version}.tar.xz

-%define sha1 linux=a40a7f291d85f9373f024946faa8c7dcb6dc7fdb

+%define sha1 linux=bcc074736b9ba1801d04371e0a9a4bfd8a5a2967

 Source1:	config

 %define ena_version 1.1.3

 Source2:    	https://github.com/amzn/amzn-drivers/archive/ena_linux_1.1.3.tar.gz

@@ -38,6 +38,12 @@ Patch17:        0001-Revert-crypto-testmgr-Disable-fips-allowed-for-authe.patch

 Patch18:        0002-allow-also-ecb-cipher_null.patch

 # Fix CVE-2017-11472

 Patch20:        ACPICA-Namespace-fix-operand-cache-leak.patch

+# Fix CVE-2017-8824

+Patch21:        dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch

+# Fix CVE-2017-17448

+Patch22:        netfilter-nfnetlink_cthelper-Add-missing-permission-checks.patch

+# Fix CVE-2017-17450

+Patch23:        netfilter-xt_osf-Add-missing-permission-checks.patch

 %if 0%{?kat_build:1}

 Patch1000:	%{kat_build}.patch

@@ -131,6 +137,9 @@ This package contains the 'perf' performance analysis tools for Linux kernel.

 %patch17 -p1

 %patch18 -p1

 %patch20 -p1

+%patch21 -p1

+%patch22 -p1

+%patch23 -p1

 %if 0%{?kat_build:1}

 %patch1000 -p1

@@ -287,6 +296,9 @@ ln -sf %{name}-%{uname_r}.cfg /boot/photon.cfg

 /usr/share/perf-core

 %changelog

+*   Tue Jan 02 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.4.109-1

+-   Version update

+-   Add patches to fix CVE-2017-8824, CVE-2017-17448 and CVE-2017-17450.

 *   Tue Dec 19 2017 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.4.106-1

 -   Version update

 *   Tue Dec 12 2017 Alexey Makhalov <amakhalov@vmware.com> 4.4.104-2

new file mode 100644

@@ -0,0 +1,73 @@

+commit 4b380c42f7d00a395feede754f0bc2292eebe6e5

+Author: Kevin Cernekee <cernekee@chromium.org>

+Date:   Sun Dec 3 12:12:45 2017 -0800

+

+    netfilter: nfnetlink_cthelper: Add missing permission checks

+    

+    The capability check in nfnetlink_rcv() verifies that the caller

+    has CAP_NET_ADMIN in the namespace that "owns" the netlink socket.

+    However, nfnl_cthelper_list is shared by all net namespaces on the

+    system.  An unprivileged user can create user and net namespaces

+    in which he holds CAP_NET_ADMIN to bypass the netlink_net_capable()

+    check:

+    

+        $ nfct helper list

+        nfct v1.4.4: netlink error: Operation not permitted

+        $ vpnns -- nfct helper list

+        {

+                .name = ftp,

+                .queuenum = 0,

+                .l3protonum = 2,

+                .l4protonum = 6,

+                .priv_data_len = 24,

+                .status = enabled,

+        };

+    

+    Add capable() checks in nfnetlink_cthelper, as this is cleaner than

+    trying to generalize the solution.

+    

+    Signed-off-by: Kevin Cernekee <cernekee@chromium.org>

+    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

+

+diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c

+index 41628b3..d33ce6d 100644

+--- a/net/netfilter/nfnetlink_cthelper.c

+@@ -17,6 +17,7 @@

+ #include <linux/types.h>

+ #include <linux/list.h>

+ #include <linux/errno.h>

++#include <linux/capability.h>

+ #include <net/netlink.h>

+ #include <net/sock.h>

+ 

+@@ -407,6 +408,9 @@ static int nfnl_cthelper_new(struct net *net, struct sock *nfnl,

+ 	struct nfnl_cthelper *nlcth;

+ 	int ret = 0;

+ 

++	if (!capable(CAP_NET_ADMIN))

++		return -EPERM;

++

+ 	if (!tb[NFCTH_NAME] || !tb[NFCTH_TUPLE])

+ 		return -EINVAL;

+ 

+@@ -611,6 +615,9 @@ static int nfnl_cthelper_get(struct net *net, struct sock *nfnl,

+ 	struct nfnl_cthelper *nlcth;

+ 	bool tuple_set = false;

+ 

++	if (!capable(CAP_NET_ADMIN))

++		return -EPERM;

++

+ 	if (nlh->nlmsg_flags & NLM_F_DUMP) {

+ 		struct netlink_dump_control c = {

+ 			.dump = nfnl_cthelper_dump_table,

+@@ -678,6 +685,9 @@ static int nfnl_cthelper_del(struct net *net, struct sock *nfnl,

+ 	struct nfnl_cthelper *nlcth, *n;

+ 	int j = 0, ret;

+ 

++	if (!capable(CAP_NET_ADMIN))

++		return -EPERM;

++

+ 	if (tb[NFCTH_NAME])

+ 		helper_name = nla_data(tb[NFCTH_NAME]);

+ 

new file mode 100644

@@ -0,0 +1,55 @@

+commit 916a27901de01446bcf57ecca4783f6cff493309

+Author: Kevin Cernekee <cernekee@chromium.org>

+Date:   Tue Dec 5 15:42:41 2017 -0800

+

+    netfilter: xt_osf: Add missing permission checks

+    

+    The capability check in nfnetlink_rcv() verifies that the caller

+    has CAP_NET_ADMIN in the namespace that "owns" the netlink socket.

+    However, xt_osf_fingers is shared by all net namespaces on the

+    system.  An unprivileged user can create user and net namespaces

+    in which he holds CAP_NET_ADMIN to bypass the netlink_net_capable()

+    check:

+    

+        vpnns -- nfnl_osf -f /tmp/pf.os

+    

+        vpnns -- nfnl_osf -f /tmp/pf.os -d

+    

+    These non-root operations successfully modify the systemwide OS

+    fingerprint list.  Add new capable() checks so that they can't.

+    

+    Signed-off-by: Kevin Cernekee <cernekee@chromium.org>

+    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

+

+diff --git a/net/netfilter/xt_osf.c b/net/netfilter/xt_osf.c

+index 36e14b1..a34f314 100644

+--- a/net/netfilter/xt_osf.c

+@@ -19,6 +19,7 @@

+ #include <linux/module.h>

+ #include <linux/kernel.h>

+ 

++#include <linux/capability.h>

+ #include <linux/if.h>

+ #include <linux/inetdevice.h>

+ #include <linux/ip.h>

+@@ -70,6 +71,9 @@ static int xt_osf_add_callback(struct net *net, struct sock *ctnl,

+ 	struct xt_osf_finger *kf = NULL, *sf;

+ 	int err = 0;

+ 

++	if (!capable(CAP_NET_ADMIN))

++		return -EPERM;

++

+ 	if (!osf_attrs[OSF_ATTR_FINGER])

+ 		return -EINVAL;

+ 

+@@ -115,6 +119,9 @@ static int xt_osf_remove_callback(struct net *net, struct sock *ctnl,

+ 	struct xt_osf_finger *sf;

+ 	int err = -ENOENT;

+ 

++	if (!capable(CAP_NET_ADMIN))

++		return -EPERM;

++

+ 	if (!osf_attrs[OSF_ATTR_FINGER])

+ 		return -EINVAL;

+