svn commit: r338606 - in releng: 10.4 10.4/sys/conf 10.4/sys/kern 11.1 11.1/sys/conf 11.1/sys/kern 11.2 11.2/sys/conf 11.2/sys/kern
Gordon Tetlow
gordon at FreeBSD.org
Wed Sep 12 05:07:39 UTC 2018
Author: gordon
Date: Wed Sep 12 05:07:35 2018
New Revision: 338606
URL: https://svnweb.freebsd.org/changeset/base/338606
Log:
Fix improper elf header parsing. [SA-18:12.elf]
Approved by: so
Security: FreeBSD-SA-18:12.elf
Security: CVE-2018-6924
Modified:
releng/10.4/UPDATING
releng/10.4/sys/conf/newvers.sh
releng/10.4/sys/kern/imgact_elf.c
releng/10.4/sys/kern/vfs_vnops.c
releng/11.1/UPDATING
releng/11.1/sys/conf/newvers.sh
releng/11.1/sys/kern/imgact_elf.c
releng/11.1/sys/kern/vfs_vnops.c
releng/11.2/UPDATING
releng/11.2/sys/conf/newvers.sh
releng/11.2/sys/kern/imgact_elf.c
releng/11.2/sys/kern/vfs_vnops.c
Modified: releng/10.4/UPDATING
==============================================================================
--- releng/10.4/UPDATING Wed Sep 12 05:03:30 2018 (r338605)
+++ releng/10.4/UPDATING Wed Sep 12 05:07:35 2018 (r338606)
@@ -17,6 +17,10 @@ stable/10, and then rebuild without this option. The b
older version of current is a bit fragile.
+20180912 p12 FreeBSD-SA-18:12.elf
+
+ Fix improper elf header parsing.
+
20180814 p11 FreeBSD-SA-18:08.tcp [revised]
FreeBSD-SA-18:11.hostapd
Modified: releng/10.4/sys/conf/newvers.sh
==============================================================================
--- releng/10.4/sys/conf/newvers.sh Wed Sep 12 05:03:30 2018 (r338605)
+++ releng/10.4/sys/conf/newvers.sh Wed Sep 12 05:07:35 2018 (r338606)
@@ -32,7 +32,7 @@
TYPE="FreeBSD"
REVISION="10.4"
-BRANCH="RELEASE-p11"
+BRANCH="RELEASE-p12"
if [ "X${BRANCH_OVERRIDE}" != "X" ]; then
BRANCH=${BRANCH_OVERRIDE}
fi
Modified: releng/10.4/sys/kern/imgact_elf.c
==============================================================================
--- releng/10.4/sys/kern/imgact_elf.c Wed Sep 12 05:03:30 2018 (r338605)
+++ releng/10.4/sys/kern/imgact_elf.c Wed Sep 12 05:07:35 2018 (r338606)
@@ -795,7 +795,8 @@ __CONCAT(exec_, __elfN(imgact))(struct image_params *i
break;
case PT_INTERP:
/* Path to interpreter */
- if (phdr[i].p_filesz > MAXPATHLEN) {
+ if (phdr[i].p_filesz < 2 ||
+ phdr[i].p_filesz > MAXPATHLEN) {
uprintf("Invalid PT_INTERP\n");
error = ENOEXEC;
goto ret;
@@ -825,6 +826,11 @@ __CONCAT(exec_, __elfN(imgact))(struct image_params *i
} else {
interp = __DECONST(char *, imgp->image_header) +
phdr[i].p_offset;
+ if (interp[interp_name_len - 1] != '\0') {
+ uprintf("Invalid PT_INTERP\n");
+ error = ENOEXEC;
+ goto ret;
+ }
}
break;
case PT_GNU_STACK:
Modified: releng/10.4/sys/kern/vfs_vnops.c
==============================================================================
--- releng/10.4/sys/kern/vfs_vnops.c Wed Sep 12 05:03:30 2018 (r338605)
+++ releng/10.4/sys/kern/vfs_vnops.c Wed Sep 12 05:07:35 2018 (r338606)
@@ -510,6 +510,8 @@ vn_rdwr(enum uio_rw rw, struct vnode *vp, void *base,
struct vn_io_fault_args args;
int error, lock_flags;
+ if (offset < 0 && vp->v_type != VCHR)
+ return (EINVAL);
auio.uio_iov = &aiov;
auio.uio_iovcnt = 1;
aiov.iov_base = base;
Modified: releng/11.1/UPDATING
==============================================================================
--- releng/11.1/UPDATING Wed Sep 12 05:03:30 2018 (r338605)
+++ releng/11.1/UPDATING Wed Sep 12 05:07:35 2018 (r338606)
@@ -16,6 +16,13 @@ from older versions of FreeBSD, try WITHOUT_CLANG and
the tip of head, and then rebuild without this option. The bootstrap process
from older version of current across the gcc/clang cutover is a bit fragile.
+20180912 p14 FreeBSD-SA-18:12.elf
+ FreeBSD-EN-18:08.lazyfpu
+
+ Fix improper elf header parsing. [SA-18:12.elf]
+
+ Fix regression in Lazy FPU remediation. [EN-18:08.lazyfpu]
+
20180814 p13 FreeBSD-SA-18:08.tcp [revised]
FreeBSD-SA-18:09.l1tf
FreeBSD-SA-18:10.ip
Modified: releng/11.1/sys/conf/newvers.sh
==============================================================================
--- releng/11.1/sys/conf/newvers.sh Wed Sep 12 05:03:30 2018 (r338605)
+++ releng/11.1/sys/conf/newvers.sh Wed Sep 12 05:07:35 2018 (r338606)
@@ -44,7 +44,7 @@
TYPE="FreeBSD"
REVISION="11.1"
-BRANCH="RELEASE-p13"
+BRANCH="RELEASE-p14"
if [ -n "${BRANCH_OVERRIDE}" ]; then
BRANCH=${BRANCH_OVERRIDE}
fi
Modified: releng/11.1/sys/kern/imgact_elf.c
==============================================================================
--- releng/11.1/sys/kern/imgact_elf.c Wed Sep 12 05:03:30 2018 (r338605)
+++ releng/11.1/sys/kern/imgact_elf.c Wed Sep 12 05:07:35 2018 (r338606)
@@ -834,7 +834,8 @@ __CONCAT(exec_, __elfN(imgact))(struct image_params *i
break;
case PT_INTERP:
/* Path to interpreter */
- if (phdr[i].p_filesz > MAXPATHLEN) {
+ if (phdr[i].p_filesz < 2 ||
+ phdr[i].p_filesz > MAXPATHLEN) {
uprintf("Invalid PT_INTERP\n");
error = ENOEXEC;
goto ret;
@@ -864,6 +865,11 @@ __CONCAT(exec_, __elfN(imgact))(struct image_params *i
} else {
interp = __DECONST(char *, imgp->image_header) +
phdr[i].p_offset;
+ if (interp[interp_name_len - 1] != '\0') {
+ uprintf("Invalid PT_INTERP\n");
+ error = ENOEXEC;
+ goto ret;
+ }
}
break;
case PT_GNU_STACK:
Modified: releng/11.1/sys/kern/vfs_vnops.c
==============================================================================
--- releng/11.1/sys/kern/vfs_vnops.c Wed Sep 12 05:03:30 2018 (r338605)
+++ releng/11.1/sys/kern/vfs_vnops.c Wed Sep 12 05:07:35 2018 (r338606)
@@ -529,6 +529,8 @@ vn_rdwr(enum uio_rw rw, struct vnode *vp, void *base,
struct vn_io_fault_args args;
int error, lock_flags;
+ if (offset < 0 && vp->v_type != VCHR)
+ return (EINVAL);
auio.uio_iov = &aiov;
auio.uio_iovcnt = 1;
aiov.iov_base = base;
Modified: releng/11.2/UPDATING
==============================================================================
--- releng/11.2/UPDATING Wed Sep 12 05:03:30 2018 (r338605)
+++ releng/11.2/UPDATING Wed Sep 12 05:07:35 2018 (r338606)
@@ -16,6 +16,13 @@ from older versions of FreeBSD, try WITHOUT_CLANG and
the tip of head, and then rebuild without this option. The bootstrap process
from older version of current across the gcc/clang cutover is a bit fragile.
+20180912 p3 FreeBSD-SA-18:12.elf
+ FreeBSD-EN-18:08.lazyfpu
+
+ Fix improper elf header parsing. [SA-18:12.elf]
+
+ Fix regression in Lazy FPU remediation. [EN-18:08.lazyfpu]
+
20180814 p2 FreeBSD-SA-18:08.tcp [revised]
FreeBSD-SA-18:09.l1tf
FreeBSD-SA-18:10.ip
Modified: releng/11.2/sys/conf/newvers.sh
==============================================================================
--- releng/11.2/sys/conf/newvers.sh Wed Sep 12 05:03:30 2018 (r338605)
+++ releng/11.2/sys/conf/newvers.sh Wed Sep 12 05:07:35 2018 (r338606)
@@ -44,7 +44,7 @@
TYPE="FreeBSD"
REVISION="11.2"
-BRANCH="RELEASE-p2"
+BRANCH="RELEASE-p3"
if [ -n "${BRANCH_OVERRIDE}" ]; then
BRANCH=${BRANCH_OVERRIDE}
fi
Modified: releng/11.2/sys/kern/imgact_elf.c
==============================================================================
--- releng/11.2/sys/kern/imgact_elf.c Wed Sep 12 05:03:30 2018 (r338605)
+++ releng/11.2/sys/kern/imgact_elf.c Wed Sep 12 05:07:35 2018 (r338606)
@@ -839,7 +839,8 @@ __CONCAT(exec_, __elfN(imgact))(struct image_params *i
break;
case PT_INTERP:
/* Path to interpreter */
- if (phdr[i].p_filesz > MAXPATHLEN) {
+ if (phdr[i].p_filesz < 2 ||
+ phdr[i].p_filesz > MAXPATHLEN) {
uprintf("Invalid PT_INTERP\n");
error = ENOEXEC;
goto ret;
@@ -869,6 +870,11 @@ __CONCAT(exec_, __elfN(imgact))(struct image_params *i
} else {
interp = __DECONST(char *, imgp->image_header) +
phdr[i].p_offset;
+ if (interp[interp_name_len - 1] != '\0') {
+ uprintf("Invalid PT_INTERP\n");
+ error = ENOEXEC;
+ goto ret;
+ }
}
break;
case PT_GNU_STACK:
Modified: releng/11.2/sys/kern/vfs_vnops.c
==============================================================================
--- releng/11.2/sys/kern/vfs_vnops.c Wed Sep 12 05:03:30 2018 (r338605)
+++ releng/11.2/sys/kern/vfs_vnops.c Wed Sep 12 05:07:35 2018 (r338606)
@@ -528,6 +528,8 @@ vn_rdwr(enum uio_rw rw, struct vnode *vp, void *base,
struct vn_io_fault_args args;
int error, lock_flags;
+ if (offset < 0 && vp->v_type != VCHR)
+ return (EINVAL);
auio.uio_iov = &aiov;
auio.uio_iovcnt = 1;
aiov.iov_base = base;
More information about the svn-src-all
mailing list