git: 62fc6a35e5 - main - Add EN-23:17 through EN-23:22 and SA-23:17.
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Tue, 05 Dec 2023 21:51:18 UTC
The branch main has been updated by gordon:
URL: https://cgit.FreeBSD.org/doc/commit/?id=62fc6a35e5fc30b0fcd6ac8d1c2b65e18077ece8
commit 62fc6a35e5fc30b0fcd6ac8d1c2b65e18077ece8
Author: Gordon Tetlow <gordon@FreeBSD.org>
AuthorDate: 2023-12-05 21:50:48 +0000
Commit: Gordon Tetlow <gordon@FreeBSD.org>
CommitDate: 2023-12-05 21:50:48 +0000
Add EN-23:17 through EN-23:22 and SA-23:17.
Approved by: so
---
website/data/security/advisories.toml | 4 +
website/data/security/errata.toml | 24 ++
.../security/advisories/FreeBSD-EN-23:17.ossl.asc | 142 ++++++++++
.../advisories/FreeBSD-EN-23:18.openzfs.asc | 135 +++++++++
.../advisories/FreeBSD-EN-23:19.pkgbase.asc | 128 +++++++++
.../security/advisories/FreeBSD-EN-23:20.vm.asc | 171 +++++++++++
.../security/advisories/FreeBSD-EN-23:21.tty.asc | 133 +++++++++
.../security/advisories/FreeBSD-EN-23:22.vfs.asc | 133 +++++++++
.../security/advisories/FreeBSD-SA-23:17.pf.asc | 165 +++++++++++
.../static/security/patches/EN-23:17/ossl.patch | 127 +++++++++
.../security/patches/EN-23:17/ossl.patch.asc | 16 ++
.../static/security/patches/EN-23:18/openzfs.patch | 315 +++++++++++++++++++++
.../security/patches/EN-23:18/openzfs.patch.asc | 16 ++
.../static/security/patches/EN-23:19/pkgbase.patch | 23 ++
.../security/patches/EN-23:19/pkgbase.patch.asc | 16 ++
website/static/security/patches/EN-23:20/vm.patch | 192 +++++++++++++
.../static/security/patches/EN-23:20/vm.patch.asc | 16 ++
website/static/security/patches/EN-23:21/tty.patch | 17 ++
.../static/security/patches/EN-23:21/tty.patch.asc | 16 ++
website/static/security/patches/EN-23:22/vfs.patch | 112 ++++++++
.../static/security/patches/EN-23:22/vfs.patch.asc | 16 ++
website/static/security/patches/SA-23:17/pf.patch | 12 +
.../static/security/patches/SA-23:17/pf.patch.asc | 16 ++
23 files changed, 1945 insertions(+)
diff --git a/website/data/security/advisories.toml b/website/data/security/advisories.toml
index d3995fcc48..dbe5ac58ce 100644
--- a/website/data/security/advisories.toml
+++ b/website/data/security/advisories.toml
@@ -1,6 +1,10 @@
# Sort advisories by year, month and day
# $FreeBSD$
+[[advisories]]
+name = "FreeBSD-SA-23:17.pf"
+date = "2023-12-05"
+
[[advisories]]
name = "FreeBSD-SA-23:16.cap_net"
date = "2023-11-08"
diff --git a/website/data/security/errata.toml b/website/data/security/errata.toml
index 4966e33623..5ac787b1f2 100644
--- a/website/data/security/errata.toml
+++ b/website/data/security/errata.toml
@@ -1,6 +1,30 @@
# Sort errata notices by year, month and day
# $FreeBSD$
+[[notices]]
+name = "FreeBSD-EN-23:22.vfs"
+date = "2023-12-05"
+
+[[notices]]
+name = "FreeBSD-EN-23:21.tty"
+date = "2023-12-05"
+
+[[notices]]
+name = "FreeBSD-EN-23:20.vm"
+date = "2023-12-05"
+
+[[notices]]
+name = "FreeBSD-EN-23:19.pkgbase"
+date = "2023-12-05"
+
+[[notices]]
+name = "FreeBSD-EN-23:18.openzfs"
+date = "2023-12-05"
+
+[[notices]]
+name = "FreeBSD-EN-23:17.ossl"
+date = "2023-12-05"
+
[[notices]]
name = "FreeBSD-EN-23:16.openzfs"
date = "2023-12-01"
diff --git a/website/static/security/advisories/FreeBSD-EN-23:17.ossl.asc b/website/static/security/advisories/FreeBSD-EN-23:17.ossl.asc
new file mode 100644
index 0000000000..7959bf01f7
--- /dev/null
+++ b/website/static/security/advisories/FreeBSD-EN-23:17.ossl.asc
@@ -0,0 +1,142 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+=============================================================================
+FreeBSD-EN-23:17.ossl Errata Notice
+ The FreeBSD Project
+
+Topic: ossl(4)'s AES-GCM implementation may give incorrect results
+
+Category: core
+Module: ossl
+Announced: 2023-12-05
+Affects: FreeBSD 14.0
+Corrected: 2023-12-03 17:48:09 UTC (stable/14, 14.0-STABLE)
+ 2023-12-05 18:27:34 UTC (releng/14.0, 14.0-RELEASE-p2)
+
+For general information regarding FreeBSD Errata Notices and Security
+Advisories, including descriptions of the fields above, security
+branches, and the following sections, please visit
+<URL:https://security.FreeBSD.org/>.
+
+I. Background
+
+ossl(4) is a kernel module which implements some cryptographic operations
+using implementations derived from OpenSSL. It integrated into the FreeBSD
+kernel's OpenCrypto Framework (OCF).
+
+II. Problem Description
+
+ossl(4) contains an implementation of AES-GCM for amd64. This implementation
+did not properly implement some aspects of the OCF interface. In particular,
+ossl(4) AES-GCM sessions were not thread-safe, and did not handle an AAD
+buffer outside of the main plaintext/ciphertext buffer. The former bug
+affects consumers which dispatch multiple requests in parallel on a single
+session, such as ZFS when encrypted datasets are configured. External AAD
+buffers are used by some network features such as ktls(4).
+
+III. Impact
+
+On amd64 systems, ossl(4) could give incorrect output for AES-GCM operations
+if consumers trigger either of the bugs described above. This could, for
+example, result in packet loss, if ossl is used to encrypt/decrypt tunnelled
+traffic, or data corruption if ossl is used to encrypt/decrypt filesystem
+data.
+
+Users are not affected by default, as ossl.ko is not loaded by default. To
+be affected, a system must either be running a custom kernel which contains
+ossl(4), or be configured to load ossl.ko via loader.conf(5).
+
+IV. Workaround
+
+Disable the use of ossl(4), either by removing it from loader.conf or the
+kernel configuration, and reboot the system. The built-in aesni(4) module
+currently implements all of the same operations as ossl, so consumers will
+not notice any functional difference.
+
+V. Solution
+
+Upgrade your system to a supported FreeBSD stable or release / security
+branch (releng) dated after the correction date. A reboot is required
+following the upgrade.
+
+Perform one of the following:
+
+1) To update your system via a binary patch:
+
+Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms,
+or the i386 platfrom on FreeBSD 13 and earlier, can be updated via
+the freebsd-update(8) utility:
+
+# freebsd-update fetch
+# freebsd-update install
+# shutdown -r now
+
+2) To update your system via a source code patch:
+
+The following patches have been verified to apply to the applicable
+FreeBSD release branches.
+
+a) Download the relevant patch from the location below, and verify the
+detached PGP signature using your PGP utility.
+
+# fetch https://security.FreeBSD.org/patches/EN-23:17/ossl.patch
+# fetch https://security.FreeBSD.org/patches/EN-23:17/ossl.patch.asc
+# gpg --verify ossl.patch.asc
+
+b) Apply the patch. Execute the following commands as root:
+
+# cd /usr/src
+# patch < /path/to/patch
+
+c) Recompile your kernel as described in
+<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
+system.
+
+VI. Correction details
+
+This issue is corrected as of the corresponding Git commit hash or Subversion
+revision number in the following stable and release branches:
+
+Branch/path Hash Revision
+- -------------------------------------------------------------------------
+stable/14/ 118b866d9c39 stable/14-n265898
+releng/14.0/ 433fe061fc59 releng/14.0-n265388
+- -------------------------------------------------------------------------
+
+Run the following command to see which files were modified by a
+particular commit:
+
+# git show --stat <commit hash>
+
+Or visit the following URL, replacing NNNNNN with the hash:
+
+<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
+
+To determine the commit count in a working tree (for comparison against
+nNNNNNN in the table above), run:
+
+# git rev-list --count --first-parent HEAD
+
+VII. References
+
+<URL:https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=275306>
+
+The latest revision of this advisory is available at
+<URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-23:17.ossl.asc>
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAEBCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmVvmVoACgkQbljekB8A
+Gu/dvQ/+KCck7lbRZYax4QZ7JxLpbutOWDITGFVMtELT7njcMMpIH6TIKLwTDpcR
+XPz/znROLquDkTpke6uf0IZyC1nMHxaYwgiTImpA0ecd3Z5n6hNj2EEhOhlitDfc
+N+UNhpQa8689CYkcm4ofgb2MQdzc/0HDTX+6tUpLuwuLhqGxyJK5bgQo63MK2osb
+qlj5TntXjVIbd33dN97JZfV9JDSapS2xLBFShe0R9+do0ucvDVOiPErHvKsLSm9P
+iYxrezxw3X6fi1BbLVe7u3B3ELeNgKnreh7CakDn/UF3hhn138d4XQ2+3ppRaadG
+81kbzMtHQHOKTRzVBrdi2sd7wDOgTapGmeeSr/87GYCOU2ZfXpZjr5k4tuD/RUOB
+44ZxeWnaNKWa4C8xr1ESr3pebTF1la2tqNQwiG/9euUn3Kl/NZFRCzaruiEmaLaG
+DeOAu3VZCucHPowA3rr80J6XPx/295Bq/bN6J5/Qd+TzKjzbqzvelXXHsn5AMjur
+tPUtG5iCLQZvivM5Wd4jaOVrZvp0ps7qlugNnOZPr/qBcW04YdwCamzwUipIDNnP
+XrxmxJdhFJhy//hnTNgJiKS6LJP5lh2ogAN6tRnvKKZrb11OAcHPIUqIyI51Bieh
+w4Yqrq2cOxMDgi7jKlSi2DLWs56WWEDob8cHhRhKhI6Fre2Yizs=
+=Vn8m
+-----END PGP SIGNATURE-----
diff --git a/website/static/security/advisories/FreeBSD-EN-23:18.openzfs.asc b/website/static/security/advisories/FreeBSD-EN-23:18.openzfs.asc
new file mode 100644
index 0000000000..892e2cfaef
--- /dev/null
+++ b/website/static/security/advisories/FreeBSD-EN-23:18.openzfs.asc
@@ -0,0 +1,135 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+=============================================================================
+FreeBSD-EN-23:18.openzfs Errata Notice
+ The FreeBSD Project
+
+Topic: High CPU usage by ZFS kernel threads
+
+Category: contrib
+Module: zfs
+Announced: 2023-12-05
+Affects: FreeBSD 14.0
+Corrected: 2023-11-22 11:43:59 UTC (stable/14, 14.0-STABLE)
+ 2023-12-05 18:27:35 UTC (releng/14.0, 14.0-RELEASE-p2)
+
+For general information regarding FreeBSD Errata Notices and Security
+Advisories, including descriptions of the fields above, security
+branches, and the following sections, please visit
+<URL:https://security.FreeBSD.org/>.
+
+I. Background
+
+ZFS is an advanced and scalable file system originally developed by Sun
+Microsystems for its Solaris operating system. ZFS was integrated as part of
+the FreeBSD starting with FreeBSD 7.0, and it has since become a prominent
+and preferred choice for storage management.
+
+II. Problem Description
+
+Because ZFS may consume large amounts of RAM to cache various types of
+filesystem objects, it continuously monitors system RAM available to decide
+whether to shrink its caches. Some caches are shrunk using a dedicated
+thread, to which work is dispatched asynchronously.
+
+In some cases, the cache shrinking logic may dispatch excessive amounts of
+work to the "ARC pruning" thread, causing it to continue attempting to shrink
+caches even after resource shortages are resolved.
+
+III. Impact
+
+The bug manifests as a kernel thread, "arc_prune", consuming 100% of a CPU
+core for indefinite periods, even while the system is otherwise idle. This
+behavior may impact workloads running on the system, by reducing available
+CPU resources and by triggering lock contention in the kernel.
+
+IV. Workaround
+
+No workaround is available. Systems not using ZFS are unaffected.
+
+V. Solution
+
+Upgrade your system to a supported FreeBSD stable or release / security
+branch (releng) dated after the correction date. A reboot is required
+following the upgrade.
+
+Perform one of the following:
+
+1) To update your system via a binary patch:
+
+Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms,
+or the i386 platfrom on FreeBSD 13 and earlier, can be updated via
+the freebsd-update(8) utility:
+
+# freebsd-update fetch
+# freebsd-update install
+
+2) To update your system via a source code patch:
+
+The following patches have been verified to apply to the applicable
+FreeBSD release branches.
+
+a) Download the relevant patch from the location below, and verify the
+detached PGP signature using your PGP utility.
+
+# fetch https://security.FreeBSD.org/patches/EN-23:18/openzfs.patch
+# fetch https://security.FreeBSD.org/patches/EN-23:18/openzfs.patch.asc
+# gpg --verify openzfs.patch.asc
+
+b) Apply the patch. Execute the following commands as root:
+
+# cd /usr/src
+# patch < /path/to/patch
+
+c) Recompile your kernel as described in
+<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
+system.
+
+VI. Correction details
+
+This issue is corrected as of the corresponding Git commit hash or Subversion
+revision number in the following stable and release branches:
+
+Branch/path Hash Revision
+- -------------------------------------------------------------------------
+stable/14/ f7f5c2419ea7 stable/14-n265783
+releng/14.0/ 64c5eaab835b releng/14.0-n265389
+- -------------------------------------------------------------------------
+
+Run the following command to see which files were modified by a
+particular commit:
+
+# git show --stat <commit hash>
+
+Or visit the following URL, replacing NNNNNN with the hash:
+
+<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
+
+To determine the commit count in a working tree (for comparison against
+nNNNNNN in the table above), run:
+
+# git rev-list --count --first-parent HEAD
+
+VII. References
+
+<URL:https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=275063>
+
+The latest revision of this advisory is available at
+<URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-23:18.openzfs.asc>
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAEBCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmVvmWEACgkQbljekB8A
+Gu9bwQ//XsLmkl7ttR+LKXCYUCLCzAZF9PXYA8IQQlUWQ39SMrEaCRP5XSBOznuy
+UtxdSfH/aQJaGb7P8b88IxMiOteYovRCApkdEY4RstaisdgDFie7XdXUDizzPZL/
+jPDSxU9I3dsHs3diQxqJRMTVtABYkErwLizLlCOJByKGUAXe+xpOibtSf2p1RtuJ
+4+EaUS6j5TDpRyocEvR/x3DsbKVZcyHevd5XCgwFl69YyX7ShmrQMJA+ytAuF6or
+l3dty1KxpwY7GJq6wIF8nM1Xo08t4uDsXyxHHOtFLBkyK5710KhrzbkDzamwKl5j
+7PhyOfj4r4+k4NhOiDPBM3O72DU4zoOpZak2BwPeT4iDoSeeJslR2SyU3dk1w76X
+bSfPWq7I3gSPcpndkskY1jCXwKo8Zm9gzu8ROF9Fg31ve/x7dVUYF+ZItppFq5k7
++o/0klvA+pCJpRWpSuDLsVyPcdmu5E25iTLDoJMjSKUiDXwdhI+AvKac4HLmd84C
+PhNmc6pVMdlFH9GdV/34wyvfyfSfhiWxxoel+ZOHZ2gjfFkwcSIFS7BNGBYvMKFi
+0k/DAsLxNlQk+nv5Z8MKaYDpAyjW3CQi+14TmLudhxqmtt25cod2+dxoyJg6F7jE
+Na47H6+jdAB3dBnNhSKaIE1eoOy1kz+RukHQxScm9kX+8x0A9o0=
+=4CJg
+-----END PGP SIGNATURE-----
diff --git a/website/static/security/advisories/FreeBSD-EN-23:19.pkgbase.asc b/website/static/security/advisories/FreeBSD-EN-23:19.pkgbase.asc
new file mode 100644
index 0000000000..8ed2c9f4ad
--- /dev/null
+++ b/website/static/security/advisories/FreeBSD-EN-23:19.pkgbase.asc
@@ -0,0 +1,128 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+=============================================================================
+FreeBSD-EN-23:19.pkgbase Errata Notice
+ The FreeBSD Project
+
+Topic: Incorrect pkgbase version number for FreeBSD 14.0
+
+Category: core
+Module: bin
+Announced: 2023-12-05
+Affects: FreeBSD 14.0
+Corrected: 2023-11-16 08:19:08 UTC (stable/14, 14.0-STABLE)
+ 2023-12-05 18:27:36 UTC (releng/14.0, 14.0-RELEASE-p2)
+
+For general information regarding FreeBSD Errata Notices and Security
+Advisories, including descriptions of the fields above, security
+branches, and the following sections, please visit
+<URL:https://security.FreeBSD.org/>.
+
+I. Background
+
+In addition to the traditional release artifacts (such as base.txz), the base
+system is also packaged into a few hundred packages installable with pkg(8)
+as part of the experimental pkgbase project.
+
+II. Problem Description
+
+The pkgbase package versions for 14.0-RELEASE packages are set to "14"
+instead of "14.0". This differs from earlier releases, for instance the
+latest pkgbase version number for releng/13.2 is "13.2p5".
+
+III. Impact
+
+Using package versions without the minor version will cause package version
+conflicts in the future for FreeBSD 14.1 and later.
+
+IV. Workaround
+
+No workaround is available. This problem only affects systems using the
+experimental pkgbase package sets.
+
+V. Solution
+
+Upgrade your system to a supported FreeBSD stable or release / security
+branch (releng) dated after the correction date. No reboot is required.
+If pkgbase is not in use on your system, no action is required.
+
+Perform one of the following:
+
+1) To update your system via a binary patch:
+
+Systems using pkgbase can be updated via the pkg(8) utility.
+
+# pkg update -r FreeBSD-base
+# pkg upgrade -r FreeBSD-base
+
+2) To update your system via a source code patch:
+
+The following patches have been verified to apply to the applicable FreeBSD
+release branches. Note that since this issue mainly affects people that
+build pkgbase packages locally, consumers of pkbbase (i.e users that have
+installed experimental pkgbase packages should update using pkg(8) as
+described above.
+
+a) Download the relevant patch from the location below, and verify the
+detached PGP signature using your PGP utility.
+
+# fetch https://security.FreeBSD.org/patches/EN-23:19/pkgbase.patch
+# fetch https://security.FreeBSD.org/patches/EN-23:19/pkgbase.patch.asc
+# gpg --verify pkgbase.patch.asc
+
+b) Apply the patch. Execute the following commands as root:
+
+# cd /usr/src
+# patch < /path/to/patch
+
+c) Recompile the operating system using buildworld and buildkernel and create
+a package set with correct version numbers using 'make packages'
+
+VI. Correction details
+
+This issue is corrected by the corresponding Git commit hash or Subversion
+revision number in the following stable and release branches:
+
+Branch/path Hash Revision
+- -------------------------------------------------------------------------
+stable/14/ da7e9601a99a stable/14-n265735
+releng/14.0/ ad3edd66d15e releng/14.0-n265390
+- -------------------------------------------------------------------------
+
+Run the following command to see which files were modified by a
+particular commit:
+
+# git show --stat <commit hash>
+
+Or visit the following URL, replacing NNNNNN with the hash:
+
+<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
+
+To determine the commit count in a working tree (for comparison against
+nNNNNNN in the table above), run:
+
+# git rev-list --count --first-parent HEAD
+
+VII. References
+
+<URL:https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=275051>
+
+The latest revision of this advisory is available at
+<URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-23:19.pkgbase.asc>
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAEBCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmVvmWMACgkQbljekB8A
+Gu+GgRAAo/xP3ZVWXUhcg9JXK2RnqTH2K4V/8f67e//HEs4wjYjkfvZe2m7yiYzu
+pvwKo+ifCmWiMEHzHiMuVIknmfD2eDfVWH687KCHBhG7CJztxickSWIIFJyuTzKb
+leg1ZBQo546SQVtamkGo8TEb+TMJhaRBz3McQ0ZxsyQJU59f02SH8Ua2swpTbZ58
+irL7PiDJi85dlmLiVry33osotdfoSkmPeNHDZFtXMhWWIy/5MVy0FBvkmA9NzR6S
+R1QozM9kXmcpEEOmt9EmW/asDFtF9p/2Ozi6wEnB67oNh2+ASynGlOD4mjYcRgYh
+/RBLT0+j4FlB2FVU7n94oysPN72dYDCAMqk7tqzGFeOjNBJ2cdlN/7iGNvi7kp65
+kgmHUd0Rr4txMb2XcxKfMOyOoknPluktNcQ2QoU9oBFR7ejNgGmSMaXIWI3O5NaQ
+pdZJEj/4eOn0A5xuWCKCW16ymgXlGYdC3DzQ71nlKREV5uZJqYBmQBI+PbVJij+C
+Z7Cxw1Ia3TKZn1B7NocRQNjPQIKLo12SLwJ+TcbxjRHE3QC8sLyYl8moXRaG4UWy
+8C4yBatzAOmn4d50JzElNHDnE+XXaKExDBBcSVab3T+Y+4z7HNINH+d6+RdNSI3L
+2MgKURXoaegGB7ExqA/kgKQliuFUg320LOrIq7gnQ47SaCBZ6xI=
+=cn6s
+-----END PGP SIGNATURE-----
diff --git a/website/static/security/advisories/FreeBSD-EN-23:20.vm.asc b/website/static/security/advisories/FreeBSD-EN-23:20.vm.asc
new file mode 100644
index 0000000000..7c80a32eff
--- /dev/null
+++ b/website/static/security/advisories/FreeBSD-EN-23:20.vm.asc
@@ -0,0 +1,171 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+=============================================================================
+FreeBSD-EN-23:20.vm Errata Notice
+ The FreeBSD Project
+
+Topic: Incorrect results from the kernel physical memory allocator
+
+Category: core
+Module: vm
+Announced: 2023-12-05
+Affects: FreeBSD 14.0
+Corrected: 2023-11-25 01:26:35 UTC (stable/14, 14.0-STABLE)
+ 2023-12-05 18:27:37 UTC (releng/14.0, 14.0-RELEASE-p2)
+
+For general information regarding FreeBSD Errata Notices and Security
+Advisories, including descriptions of the fields above, security
+branches, and the following sections, please visit
+<URL:https://security.FreeBSD.org/>.
+
+I. Background
+
+The FreeBSD kernel implements a physical memory allocator which is
+responsible for managing the system's RAM. This allocator provides
+interfaces which allow kernel code to request the allocation of memory which
+satisifies certain constraints, such as bounds on the physical address range
+for returned memory, and alignment of the returned physical pages.
+
+One use of the physical memory allocator is to allocate memory for DMA for
+device drivers, which may have special requirements. For example, a common
+constraint is that DMA memory be allocated from the lowest 4GB of the
+physical address space.
+
+II. Problem Description
+
+The code which implements the physical memory allocator in FreeBSD 14.0
+contains a bug such that the returned physical memory may, in some
+circumstances, fail to satisfy the specified constraints.
+
+III. Impact
+
+The effects of the bug do not have a simple characterization, as different
+users of the interface may be affected differently by the bug. In one case,
+the symptom was that the affected system would occasionally panic during
+boot. It is believed that most users will be unaffected by the problem.
+
+IV. Workaround
+
+No workaround is available.
+
+V. Solution
+
+<insert solution here>
+
+Upgrade your system to a supported FreeBSD stable or release / security
+branch (releng) dated after the correction date. A reboot is required
+following the upgrade.
+
+Perform one of the following:
+
+1) To update your system via a binary patch:
+
+Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms,
+or the i386 platfrom on FreeBSD 13 and earlier, can be updated via
+the freebsd-update(8) utility:
+
+# freebsd-update fetch
+# freebsd-update install
+
+2) To update your system via a source code patch:
+
+The following patches have been verified to apply to the applicable
+FreeBSD release branches.
+
+a) Download the relevant patch from the location below, and verify the
+detached PGP signature using your PGP utility.
+
+[FreeBSD 12.4]
+# fetch https://security.FreeBSD.org/patches/EN-23:20/vm.patch
+# fetch https://security.FreeBSD.org/patches/EN-23:20/vm.patch.asc
+# gpg --verify vm.patch.asc
+
+b) Apply the patch. Execute the following commands as root:
+
+# cd /usr/src
+# patch < /path/to/patch
+
+<for a userland utility:>
+
+c) Recompile the operating system using buildworld and installworld as
+described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
+
+<for a daemons>
+
+c) Recompile the operating system using buildworld and installworld as
+described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
+
+Restart the applicable daemons, or reboot the system.
+
+<for a common library>
+
+c) Recompile the operating system using buildworld and installworld as
+described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
+
+Restart all daemons that use the library, or reboot the system.
+
+<for a kernel bug:>
+
+c) Recompile your kernel as described in
+<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
+system.
+
+VI. Correction details
+
+This issue is corrected as of the corresponding Git commit hash or Subversion
+revision number in the following stable and release branches:
+
+Branch/path Hash Revision
+- -------------------------------------------------------------------------
+stable/14/ 210fce73ae0e stable/14-n265801
+releng/14.0/ 4be96902ba82 releng/14.0-n265391
+- -------------------------------------------------------------------------
+
+Run the following command to see which files were modified by a
+particular commit:
+
+# git show --stat <commit hash>
+
+Or visit the following URL, replacing NNNNNN with the hash:
+
+<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
+
+To determine the commit count in a working tree (for comparison against
+nNNNNNN in the table above), run:
+
+# git rev-list --count --first-parent HEAD
+
+For FreeBSD 12 and earlier:
+
+Run the following command to see which files were modified by a particular
+revision, replacing NNNNNN with the revision number:
+
+# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
+
+Or visit the following URL, replacing NNNNNN with the revision number:
+
+<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
+
+VII. References
+
+<URL:https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=274592>
+
+The latest revision of this advisory is available at
+<URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-23:20.vm.asc>
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAEBCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmVvmWUACgkQbljekB8A
+Gu+kRhAAtUSzuLKhrxQc3+FfL4M+GvebvPkQASFygFCzQR1mXJJFnFl4UkLMNlnN
+83zzFbSC5jVxGUrlu1BDmgIZobmB1/INKE/dcl/GRTqJuQhzYGJ+Q5lAGX5AQV2H
+kmYEUuGmMT8YR1KsDY9f+4yB61hkSbm8snOO4VRb1D+CBUCF2skKPrZu25+xDsxV
+888LY1X0LAO7Udvk9DEldWRM6IYeXuIn24mfUIkPYF62sBb82jW1w+LC148W2xIz
+F6jr9N9CBqhthpujWSMmKymOFSEg9HcKPJ55CEE1LCIhuxtz7h0GxP+GN9l4vc3b
+FfvQHcoxin9wpmaYevPXLoAW415lMvvgurP12NirDgB5lEadPEfnhckLO9ndw5y7
+PmSOKwKQlDfBHMwjTnlUUE3G8kw5FOXcT7/qr3x++Cl3tBNTGaei9A6EpFD3mzNS
+y0BH7bwYbr/GjSMJAeH3SI9il3hTA9/4jP8KATIUGuIWJJGqlFJR3uuubh2pIdR9
+qrHpA6JqcYjbRyK3+AkV1EXPoRmOjt/uYbRld/8HIkFMrD/cBvh7R+mP4+XU4k5y
+eYgoPxjJat63XIfzqtFPkAVH+h+bbvUpzaikrArQuvshq/4IrO3NV1ub6gZWc6N7
+QfsBKolQQ37FgHKmIbrBFOegmDuiaaXGVLDH3s7fWYmKl9DRr/8=
+=con6
+-----END PGP SIGNATURE-----
diff --git a/website/static/security/advisories/FreeBSD-EN-23:21.tty.asc b/website/static/security/advisories/FreeBSD-EN-23:21.tty.asc
new file mode 100644
index 0000000000..d0475aa4d3
--- /dev/null
+++ b/website/static/security/advisories/FreeBSD-EN-23:21.tty.asc
@@ -0,0 +1,133 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+=============================================================================
+FreeBSD-EN-23:21.tty Errata Notice
+ The FreeBSD Project
+
+Topic: tty(4) IUTF8 causes a kernel panic
+
+Category: core
+Module: tty
+Announced: 2023-11-24
+Affects: FreeBSD 14.0
+Corrected: 2023-11-20 16:54:54 UTC (stable/14, 14.0-STABLE)
+ 2023-12-05 18:27:38 UTC (releng/14.0, 14.0-RELEASE-p2)
+ 2023-11-20 16:57:49 UTC (stable/13, 13.2-STABLE)
+
+For general information regarding FreeBSD Errata Notices and Security
+Advisories, including descriptions of the fields above, security
+branches, and the following sections, please visit
+<URL:https://security.FreeBSD.org/>.
+
+Note: This issue does not affect 13.2-RELEASE, as the bug was introduced into
+the stable/13 branch after the 13.2 release.
+
+I. Background
+
+The IUTF8 flag was added to the tty(4) subsystem in order to add proper
+backspace handling for UTF-8 characters. Without this flag, tty(4) treats
+all characters as single-byte-wide characters and so, in the case of a UTF-8
+character two bytes in size or larger, tty(4) deletes only one byte during a
+backspace event, instead of all bytes, which results in the tty buffer
+containing garbage.
+
+II. Problem Description
+
+The implementation of backspace handling failed to check whether the TTY
+buffer was empty, in which case the kernel could panic.
+
+III. Impact
+
+An unprivileged user may be able to trigger a kernel panic.
+
+IV. Workaround
+
+No workaround is available.
+
+V. Solution
+
+Upgrade your system to a supported FreeBSD stable or release / security branch
+(releng) dated after the correction date, and reboot.
+
+Perform one of the following:
+
+1) To update your system via a binary patch:
+
+Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms,
+or the i386 platfrom on FreeBSD 13 and earlier, can be updated via
+the freebsd-update(8) utility:
+
+# freebsd-update fetch
+# freebsd-update install
+# shutdown -r +10min "Rebooting for a security update"
+
+2) To update your system via a source code patch:
+
+The following patches have been verified to apply to the applicable
+FreeBSD release branches.
+
+a) Download the relevant patch from the location below, and verify the
+detached PGP signature using your PGP utility.
+
+# fetch https://security.FreeBSD.org/patches/EN-23:21/tty.patch
+# fetch https://security.FreeBSD.org/patches/EN-23:21/tty.patch.asc
+# gpg --verify tty.patch.asc
+
+b) Apply the patch. Execute the following commands as root:
+
+# cd /usr/src
+# patch < /path/to/patch
+
+c) Recompile your kernel as described in
+<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
+system.
+
+VI. Correction details
+
+This issue is corrected as of the corresponding Git commit hash or Subversion
+revision number in the following stable and release branches:
+
+Branch/path Hash Revision
+- -------------------------------------------------------------------------
+stable/14/ ae8387cc818a stable/14-n265760
+releng/14.0/ 31f6cfca851f releng/14.0-n265392
+stable/13/ 8647fe60b8c3 stable/13-n256709
+- -------------------------------------------------------------------------
+
+Run the following command to see which files were modified by a
+particular commit:
+
+# git show --stat <commit hash>
+
+Or visit the following URL, replacing NNNNNN with the hash:
+
+<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
+
+To determine the commit count in a working tree (for comparison against
+nNNNNNN in the table above), run:
+
+# git rev-list --count --first-parent HEAD
+
+VII. References
+
+<URL:https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=275009>
+
+The latest revision of this advisory is available at
+<URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-23:21.tty.asc>
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAEBCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmVvmWcACgkQbljekB8A
+Gu+WfxAA4+u5wXTSy1UcpO17JzFuo0JjhQUcOEh3uWRCPdgpokEkv7xnjJQz8W3u
+0c1GtigtKLOvJx6gF4ilFQhVbxtFNj5a73ODPqcy0K0x7YPw/5Rbrl+jk7389NXT
+A5H7kT7bscF6x9D7YfAkA2/JSgSS3opx6KJhOP8x8DvNuNpl/v2ja1LAcIVjytu6
+YYBz/GaODjX4iOw8dYzQetmbeEOiKZX660Eq5Sm2UySRz/BpJpT3y1Ncl84dWC+H
+otBihg1iezD5Ju4TIbGz6/N2oSf6mEQ2jx+ahNPGHj/A4fUeBajZWJZrge4Birii
+c45EIcPUzyt8Q4Xjcn4qCKJ3MHGCR65/39oK5DbOXD62t3l/vbLSbHToYjeJWyTN
+Fl/hOtVSrF7Om0qhlrNOfS2jXIcTQDBQJ/vgjC+m+FTDtnyiSSAZfYXQz4Ckkqfw
+KMPc3N9YI7aoifyTQxj508WN1dma7eRwyupLabwfOij03vmN/4tAI89v6EEefhpM
+wTUPTgebQWgHJjjUi7Mo8EXSzWxtPbdt2UX8XtVw3EpjQOqqc0vv+VJxkCAdMdDO
+fE8614WWcHppswXi7dlWgKUcMEEdtZ48+QjM1h+fA8DeNk6FSLBJXLUQnll1QPEW
+VDj9oKnoXquQyuxWB8MwbiUfrLlAhAXhfC8nG+Ci75sts0E4jQE=
+=wp8X
+-----END PGP SIGNATURE-----
diff --git a/website/static/security/advisories/FreeBSD-EN-23:22.vfs.asc b/website/static/security/advisories/FreeBSD-EN-23:22.vfs.asc
new file mode 100644
index 0000000000..e6fb59ced8
--- /dev/null
+++ b/website/static/security/advisories/FreeBSD-EN-23:22.vfs.asc
@@ -0,0 +1,133 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+=============================================================================
+FreeBSD-EN-23:22.vfs Errata Notice
+ The FreeBSD Project
+
+Topic: ZFS snapshot directories not accessible over NFS
+
+Category: core
+Module: vfs
+Announced: 2023-12-05
+Affects: FreeBSD 14.0
+Corrected: 2023-12-01 13:27:28 UTC (stable/14, 14.0-STABLE)
+ 2023-12-05 18:27:40 UTC (releng/14.0, 14.0-RELEASE-p2)
+ 2023-12-04 21:03:42 UTC (stable/13, 13.2-STABLE)
+
+For general information regarding FreeBSD Errata Notices and Security
+Advisories, including descriptions of the fields above, security
+branches, and the following sections, please visit
+<URL:https://security.FreeBSD.org/>.
+
+I. Background
+
+ZFS is one of several filesystems available on FreeBSD. ZFS supports many
+advanced features, including checksumming, transparent compression, and
+snapshots.
+
+Snapshots of a ZFS dataset can be accessed through a hidden directory,
+.zfs/snapshots, located in the root of the mounted dataset.
+
+II. Problem Description
+
+When a process attempts to access a snapshot under /<dataset>/.zfs/snapshot,
+the snapshot is automounted. However, without this patch, the automount does
+not properly set some metadata in the kernel's representation of the mount
+point, which results in the snapshot not being accessible over NFS.
+
+III. Impact
+
+Workflows which rely on ZFS snapshots being accessible over NFS are broken.
+
+IV. Workaround
+
+No workaround is available.
+
+V. Solution
+
+Upgrade your system to a supported FreeBSD stable or release / security
+branch (releng) dated after the correction date. A reboot is required after
+the upgrade procedure has been completed.
+
+Perform one of the following:
+
+1) To update your system via a binary patch:
+
+Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms,
+or the i386 platfrom on FreeBSD 13 and earlier, can be updated via
+the freebsd-update(8) utility:
+
+# freebsd-update fetch
+# freebsd-update install
+# shutdown -r now
+
+2) To update your system via a source code patch:
+
+The following patches have been verified to apply to the applicable
+FreeBSD release branches.
+
+a) Download the relevant patch from the location below, and verify the
+detached PGP signature using your PGP utility.
+
+# fetch https://security.FreeBSD.org/patches/EN-23:22/vfs.patch
+# fetch https://security.FreeBSD.org/patches/EN-23:22/vfs.patch.asc
+# gpg --verify vfs.patch.asc
+
+b) Apply the patch. Execute the following commands as root:
+
+# cd /usr/src
+# patch < /path/to/patch
+
+c) Recompile your kernel as described in
+<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
+system.
+
+VI. Correction details
+
+This issue is corrected as of the corresponding Git commit hash or Subversion
+revision number in the following stable and release branches:
+
+Branch/path Hash Revision
+- -------------------------------------------------------------------------
+stable/14/ 62304a0c3b8b stable/14-n265867
+releng/14.0/ 889ecd8fd178 releng/14.0-n265394
+stable/13/ 00f0b99e63c3 stable/13-n256835
+- -------------------------------------------------------------------------
+
+Run the following command to see which files were modified by a
+particular commit:
+
+# git show --stat <commit hash>
+
+Or visit the following URL, replacing NNNNNN with the hash:
+
+<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
+
+To determine the commit count in a working tree (for comparison against
+nNNNNNN in the table above), run:
+
+# git rev-list --count --first-parent HEAD
+
+VII. References
+
+<URL:https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=275200>
+
+The latest revision of this advisory is available at
+<URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-23:22.vfs.asc>
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAEBCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmVvmWkACgkQbljekB8A
+Gu+7TBAAt31ElRhk83oPelDQ0Trq1ngDk7qWabeG+ODjS6mptke5mqBn0ZvFyTNb
+z+x6biXUGnE9o9P4T0mdE/euSGSHQWASU+DwycRqkEM4Xo7rMWrheOGwFBJ+1g/z
+ZQyowYL8HRIOQ7Ijal1NTZ2S/HpAvXdyuGsxYYimyZyckOAe+ZzmUiCmlvvLJCdk
+m8uUnRidevXWiUrRW9MNBHG5XoNwT7je5KT/RxqqeJQ4ObWEywjsHxwZn1Px1vQw
+ycjbL82sKrv2FiXf2FdvC2xbji5QkrLTf+EOecreTKaiyMcooT9h+ZQUiRj3ChbW
+KHszVdwYrGmDx9OOq+JWWqf+KgEfmiisFQsqHpq4Zc4RTKhPwAV/PX7+cLvBlX85
+QgNupyGLkwOkrAb3hdC7dsPTZl4htFJzC49CDH4IZNIJxQ7pTa0LDujyybacnYE+
+reCe6DZ5aY+TULHlCTfGZ21OcpiEDrCmvFoZhZHuEZxMl9LjIf1jjpGPFP+lPJ7u
+nG5VXRjFfFdGtuiyfzs4UsYD5XOn+hgcZl8vkMgfXQU0LwPyKHxo3k+vg5rdxImI
+HWZPYlo6D+lrtIBW3LLjiHrhHrekruqN2RT8cmkSOftihLdNuO8KC72DE0Co/D49
+QeVeOv5tkNyc0/M7TVEYapIYGCTb5VpawZNyr6ABLwnXDyQ8rck=
+=ufsO
+-----END PGP SIGNATURE-----
diff --git a/website/static/security/advisories/FreeBSD-SA-23:17.pf.asc b/website/static/security/advisories/FreeBSD-SA-23:17.pf.asc
new file mode 100644
index 0000000000..e06ff7e005
--- /dev/null
+++ b/website/static/security/advisories/FreeBSD-SA-23:17.pf.asc
@@ -0,0 +1,165 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+=============================================================================
+FreeBSD-SA-23:17.pf Security Advisory
+ The FreeBSD Project
+
+Topic: TCP spoofing vulnerability in pf(4)
+
+Category: core
+Module: pf
+Announced: 2023-12-05
+Credits: Yuxiang Yang, Ao Wang, Xuewei Feng, Qi Li and Ke Xu from
*** 1146 LINES SKIPPED ***