Browse code
kernels: fix CVE-2017-11600
Change-Id: I7e93df393841cae832857391bc8524ccde902410
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/3694
Tested-by: gerrit-photon <photon-checkins@vmware.com>
Reviewed-by: Bo Gan <ganb@vmware.com>
Alexey Makhalov authored on 2017/09/04 17:49:01Showing 4 changed files
- SPECS/linux-api-headers/linux-api-headers.spec
- SPECS/linux/linux-esx.spec
- SPECS/linux/linux.spec
- SPECS/linux/xfrm-policy-check-policy-direction-value.patch
| ... | ... |
@@ -1,14 +1,14 @@ |
| 1 | 1 |
Summary: Linux API header files |
| 2 | 2 |
Name: linux-api-headers |
| 3 |
-Version: 4.4.82 |
|
| 4 |
-Release: 2%{?dist}
|
|
| 3 |
+Version: 4.4.86 |
|
| 4 |
+Release: 1%{?dist}
|
|
| 5 | 5 |
License: GPLv2 |
| 6 | 6 |
URL: http://www.kernel.org/ |
| 7 | 7 |
Group: System Environment/Kernel |
| 8 | 8 |
Vendor: VMware, Inc. |
| 9 | 9 |
Distribution: Photon |
| 10 | 10 |
Source0: http://www.kernel.org/pub/linux/kernel/v4.x/linux-%{version}.tar.xz
|
| 11 |
-%define sha1 linux=27a2c7d466ec5b93712a9e17fa564652a0c06142 |
|
| 11 |
+%define sha1 linux=f70a59faebdb8f5d8e865b7f9eca1e05b4044b63 |
|
| 12 | 12 |
BuildArch: noarch |
| 13 | 13 |
# From SPECS/linux and used by linux-esx only |
| 14 | 14 |
# It provides f*xattrat syscalls |
| ... | ... |
@@ -29,6 +29,8 @@ find /%{buildroot}%{_includedir} \( -name .install -o -name ..install.cmd \) -de
|
| 29 | 29 |
%defattr(-,root,root) |
| 30 | 30 |
%{_includedir}/*
|
| 31 | 31 |
%changelog |
| 32 |
+* Mon Sep 04 2017 Alexey Makhalov <amakhalov@vmware.com> 4.4.86-1 |
|
| 33 |
+- Version update |
|
| 32 | 34 |
* Wed Aug 16 2017 Alexey Makhalov <amakhalov@vmware.com> 4.4.82-2 |
| 33 | 35 |
- Implement the f*xattrat family of syscalls |
| 34 | 36 |
* Tue Aug 15 2017 Alexey Makhalov <amakhalov@vmware.com> 4.4.82-1 |
| ... | ... |
@@ -1,15 +1,15 @@ |
| 1 | 1 |
%global security_hardening none |
| 2 | 2 |
Summary: Kernel |
| 3 | 3 |
Name: linux-esx |
| 4 |
-Version: 4.4.82 |
|
| 5 |
-Release: 2%{?dist}
|
|
| 4 |
+Version: 4.4.86 |
|
| 5 |
+Release: 1%{?dist}
|
|
| 6 | 6 |
License: GPLv2 |
| 7 | 7 |
URL: http://www.kernel.org/ |
| 8 | 8 |
Group: System Environment/Kernel |
| 9 | 9 |
Vendor: VMware, Inc. |
| 10 | 10 |
Distribution: Photon |
| 11 | 11 |
Source0: http://www.kernel.org/pub/linux/kernel/v4.x/linux-%{version}.tar.xz
|
| 12 |
-%define sha1 linux=27a2c7d466ec5b93712a9e17fa564652a0c06142 |
|
| 12 |
+%define sha1 linux=f70a59faebdb8f5d8e865b7f9eca1e05b4044b63 |
|
| 13 | 13 |
Source1: config-esx |
| 14 | 14 |
Patch0: double-tcp_mem-limits.patch |
| 15 | 15 |
Patch1: linux-4.4-sysctl-sched_weighted_cpuload_uses_rla.patch |
| ... | ... |
@@ -36,6 +36,8 @@ Patch21: vmci-1.1.5.0-doorbell-create-and-destroy-fixes.patch |
| 36 | 36 |
Patch22: net-9p-vsock.patch |
| 37 | 37 |
Patch23: p9fs_dir_readdir-offset-support.patch |
| 38 | 38 |
Patch24: Implement-the-f-xattrat-family-of-functions.patch |
| 39 |
+# Fix CVE-2017-11600 |
|
| 40 |
+Patch25: xfrm-policy-check-policy-direction-value.patch |
|
| 39 | 41 |
|
| 40 | 42 |
BuildRequires: bc |
| 41 | 43 |
BuildRequires: kbd |
| ... | ... |
@@ -97,6 +99,7 @@ The Linux package contains the Linux kernel doc files |
| 97 | 97 |
%patch22 -p1 |
| 98 | 98 |
%patch23 -p1 |
| 99 | 99 |
%patch24 -p1 |
| 100 |
+%patch25 -p1 |
|
| 100 | 101 |
|
| 101 | 102 |
%build |
| 102 | 103 |
# patch vmw_balloon driver |
| ... | ... |
@@ -185,6 +188,8 @@ ln -sf linux-%{uname_r}.cfg /boot/photon.cfg
|
| 185 | 185 |
/usr/src/linux-headers-%{uname_r}
|
| 186 | 186 |
|
| 187 | 187 |
%changelog |
| 188 |
+* Mon Sep 04 2017 Alexey Makhalov <amakhalov@vmware.com> 4.4.86-1 |
|
| 189 |
+- Fix CVE-2017-11600 |
|
| 188 | 190 |
* Wed Aug 16 2017 Alexey Makhalov <amakhalov@vmware.com> 4.4.82-2 |
| 189 | 191 |
- Implement the f*xattrat family of syscalls |
| 190 | 192 |
* Tue Aug 15 2017 Alexey Makhalov <amakhalov@vmware.com> 4.4.82-1 |
| ... | ... |
@@ -1,15 +1,15 @@ |
| 1 | 1 |
%global security_hardening none |
| 2 | 2 |
Summary: Kernel |
| 3 | 3 |
Name: linux |
| 4 |
-Version: 4.4.82 |
|
| 5 |
-Release: 2%{?dist}
|
|
| 4 |
+Version: 4.4.86 |
|
| 5 |
+Release: 1%{?dist}
|
|
| 6 | 6 |
License: GPLv2 |
| 7 | 7 |
URL: http://www.kernel.org/ |
| 8 | 8 |
Group: System Environment/Kernel |
| 9 | 9 |
Vendor: VMware, Inc. |
| 10 | 10 |
Distribution: Photon |
| 11 | 11 |
Source0: http://www.kernel.org/pub/linux/kernel/v4.x/%{name}-%{version}.tar.xz
|
| 12 |
-%define sha1 linux=27a2c7d466ec5b93712a9e17fa564652a0c06142 |
|
| 12 |
+%define sha1 linux=f70a59faebdb8f5d8e865b7f9eca1e05b4044b63 |
|
| 13 | 13 |
Source1: config |
| 14 | 14 |
%define ena_version 1.1.3 |
| 15 | 15 |
Source2: https://github.com/amzn/amzn-drivers/archive/ena_linux_1.1.3.tar.gz |
| ... | ... |
@@ -38,6 +38,8 @@ Patch17: 0001-Revert-crypto-testmgr-Disable-fips-allowed-for-authe.patch |
| 38 | 38 |
Patch18: 0002-allow-also-ecb-cipher_null.patch |
| 39 | 39 |
# Fix CVE-2017-10911 |
| 40 | 40 |
Patch19: xen-blkback-dont-leak-stack-data-via-response-ring.patch |
| 41 |
+# Fix CVE-2017-11600 |
|
| 42 |
+Patch20: xfrm-policy-check-policy-direction-value.patch |
|
| 41 | 43 |
|
| 42 | 44 |
BuildRequires: bc |
| 43 | 45 |
BuildRequires: kbd |
| ... | ... |
@@ -128,6 +130,7 @@ This package contains the 'perf' performance analysis tools for Linux kernel. |
| 128 | 128 |
%patch17 -p1 |
| 129 | 129 |
%patch18 -p1 |
| 130 | 130 |
%patch19 -p1 |
| 131 |
+%patch20 -p1 |
|
| 131 | 132 |
|
| 132 | 133 |
%build |
| 133 | 134 |
make mrproper |
| ... | ... |
@@ -280,6 +283,8 @@ ln -sf %{name}-%{uname_r}.cfg /boot/photon.cfg
|
| 280 | 280 |
/usr/share/perf-core |
| 281 | 281 |
|
| 282 | 282 |
%changelog |
| 283 |
+* Mon Sep 04 2017 Alexey Makhalov <amakhalov@vmware.com> 4.4.86-1 |
|
| 284 |
+- Fix CVE-2017-11600 |
|
| 283 | 285 |
* Thu Aug 17 2017 Alexey Makhalov <amakhalov@vmware.com> 4.4.82-2 |
| 284 | 286 |
- .config: disable XEN_BALLOON_MEMORY_HOTPLUG |
| 285 | 287 |
* Tue Aug 15 2017 Alexey Makhalov <amakhalov@vmware.com> 4.4.82-1 |
| 286 | 288 |
new file mode 100644 |
| ... | ... |
@@ -0,0 +1,44 @@ |
| 0 |
+From 7bab09631c2a303f87a7eb7e3d69e888673b9b7e Mon Sep 17 00:00:00 2001 |
|
| 1 |
+From: Vladis Dronov <vdronov@redhat.com> |
|
| 2 |
+Date: Wed, 2 Aug 2017 19:50:14 +0200 |
|
| 3 |
+Subject: xfrm: policy: check policy direction value |
|
| 4 |
+ |
|
| 5 |
+The 'dir' parameter in xfrm_migrate() is a user-controlled byte which is used |
|
| 6 |
+as an array index. This can lead to an out-of-bound access, kernel lockup and |
|
| 7 |
+DoS. Add a check for the 'dir' value. |
|
| 8 |
+ |
|
| 9 |
+This fixes CVE-2017-11600. |
|
| 10 |
+ |
|
| 11 |
+References: https://bugzilla.redhat.com/show_bug.cgi?id=1474928 |
|
| 12 |
+Fixes: 80c9abaabf42 ("[XFRM]: Extension for dynamic update of endpoint address(es)")
|
|
| 13 |
+Cc: <stable@vger.kernel.org> # v2.6.21-rc1 |
|
| 14 |
+Reported-by: "bo Zhang" <zhangbo5891001@gmail.com> |
|
| 15 |
+Signed-off-by: Vladis Dronov <vdronov@redhat.com> |
|
| 16 |
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> |
|
| 17 |
+--- |
|
| 18 |
+ net/xfrm/xfrm_policy.c | 6 ++++++ |
|
| 19 |
+ 1 file changed, 6 insertions(+) |
|
| 20 |
+ |
|
| 21 |
+diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c |
|
| 22 |
+index ff61d85..6f5a0dad 100644 |
|
| 23 |
+--- a/net/xfrm/xfrm_policy.c |
|
| 24 |
+@@ -3308,9 +3308,15 @@ int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, |
|
| 25 |
+ struct xfrm_state *x_new[XFRM_MAX_DEPTH]; |
|
| 26 |
+ struct xfrm_migrate *mp; |
|
| 27 |
+ |
|
| 28 |
++ /* Stage 0 - sanity checks */ |
|
| 29 |
+ if ((err = xfrm_migrate_check(m, num_migrate)) < 0) |
|
| 30 |
+ goto out; |
|
| 31 |
+ |
|
| 32 |
++ if (dir >= XFRM_POLICY_MAX) {
|
|
| 33 |
++ err = -EINVAL; |
|
| 34 |
++ goto out; |
|
| 35 |
++ } |
|
| 36 |
++ |
|
| 37 |
+ /* Stage 1 - find policy */ |
|
| 38 |
+ if ((pol = xfrm_migrate_policy_find(sel, dir, type, net)) == NULL) {
|
|
| 39 |
+ err = -ENOENT; |
|
| 40 |
+-- |
|
| 41 |
+cgit v1.1 |
|
| 42 |
+ |