From 120c804b5bf01f7fd264ac5e2a4d5555068e26bc Mon Sep 17 00:00:00 2001 From: Tim Yamin Date: Sat, 6 Nov 2004 21:36:45 +0000 Subject: [PATCH] Fix for the kNFSd security vulnerability, bug #62524 and the CAN-2004-0814 vulnerability, bug #68421. --- sys-kernel/alpha-sources/ChangeLog | 9 +- sys-kernel/alpha-sources/Manifest | 8 +- ...ebuild => alpha-sources-2.4.21-r13.ebuild} | 11 +- .../files/alpha-sources-2.4.19.rtc_fix.patch | 115 ------------------ .../files/alpha-sources.XDRWrapFix.patch | 48 ++++++++ ...21-r12 => digest-alpha-sources-2.4.21-r13} | 1 + 6 files changed, 68 insertions(+), 124 deletions(-) rename sys-kernel/alpha-sources/{alpha-sources-2.4.21-r12.ebuild => alpha-sources-2.4.21-r13.ebuild} (90%) delete mode 100644 sys-kernel/alpha-sources/files/alpha-sources-2.4.19.rtc_fix.patch create mode 100644 sys-kernel/alpha-sources/files/alpha-sources.XDRWrapFix.patch rename sys-kernel/alpha-sources/files/{digest-alpha-sources-2.4.21-r12 => digest-alpha-sources-2.4.21-r13} (72%) diff --git a/sys-kernel/alpha-sources/ChangeLog b/sys-kernel/alpha-sources/ChangeLog index 58bd6002c5dc..a4c249e76ca7 100644 --- a/sys-kernel/alpha-sources/ChangeLog +++ b/sys-kernel/alpha-sources/ChangeLog @@ -1,6 +1,13 @@ # ChangeLog for sys-kernel/alpha-sources # Copyright 2002-2004 Gentoo Foundation; Distributed under the GPL v2 -# $Header: /var/cvsroot/gentoo-x86/sys-kernel/alpha-sources/ChangeLog,v 1.34 2004/08/09 22:56:41 plasmaroo Exp $ +# $Header: /var/cvsroot/gentoo-x86/sys-kernel/alpha-sources/ChangeLog,v 1.35 2004/11/06 21:36:45 plasmaroo Exp $ + +*alpha-sources-2.4.21-r13 (06 Nov 2004) + + 06 Nov 2004; -alpha-sources-2.4.21-r12.ebuild, + +alpha-sources-2.4.21-r13.ebuild, +files/alpha-sources.XDRWrapFix.patch: + Fix for the kNFSd security vulnerability, bug #62524 and the CAN-2004-0814 + vulnerability, bug #68421. *alpha-sources-2.4.21-r12 (09 Aug 2004) diff --git a/sys-kernel/alpha-sources/Manifest b/sys-kernel/alpha-sources/Manifest index 1d3807a2799b..576c77177c9e 100644 --- a/sys-kernel/alpha-sources/Manifest +++ b/sys-kernel/alpha-sources/Manifest @@ -1,6 +1,6 @@ -MD5 9f9fe5a3022b34e41aae18535b87aa22 ChangeLog 6059 -MD5 db10c1c7534752a247be1523be268ee2 alpha-sources-2.4.21-r12.ebuild 4175 -MD5 323e19d6d35ebd2e9300669e0a7bad6b files/digest-alpha-sources-2.4.21-r12 220 +MD5 f14a1dfd35689011c91fa6f936139947 ChangeLog 6354 +MD5 17504aeaa8c0fca573e78ce8067f3cb8 alpha-sources-2.4.21-r13.ebuild 4442 +MD5 2b3ddb8b8b15f8da35ade38544b57857 files/alpha-sources.XDRWrapFix.patch 1499 MD5 5bf9836a632a861728d33f9736bb7431 files/alpha-sources.CAN-2004-0133.patch 427 MD5 d1ccc2047be533c992f67270a150a210 files/alpha-sources.cmdlineLeak.patch 388 MD5 c460ea130cb4ae84a5063ba044e3ce72 files/alpha-sources.CAN-2004-0427.patch 460 @@ -8,7 +8,6 @@ MD5 9c816c892d6e3d3f0b7b77d3d503ab10 files/alpha-sources.CAN-2004-0075.patch 634 MD5 d4a740ae56c2049247083af387a22a85 files/alpha-sources.CAN-2004-0394.patch 350 MD5 147fec50180ad91b6260fc7201dcb90f files/alpha-sources.CAN-2004-0010.patch 6050 MD5 dc18e982f8149588a291956481885a8c files/alpha-sources.CAN-2004-0495.patch 17549 -MD5 df40eece807d039cba79f477e80ebda2 files/alpha-sources-2.4.19.rtc_fix.patch 4974 MD5 a61e57d5483a06f20da339d91f98fbb8 files/alpha-sources.rtc_fix.patch 6769 MD5 174438d215b70cad5ffb00ca8123c062 files/alpha-sources.munmap.patch 837 MD5 60d25ff310fc6abfdce39ec9e47345af files/alpha-sources.CAN-2004-0685.patch 2809 @@ -16,6 +15,7 @@ MD5 3bdf00d5f80fe9dfbfe8220e076cd04c files/alpha-sources.CAN-2004-0497.patch 707 MD5 e77a93fdf26f06cf3ea5080b27211725 files/alpha-sources.CAN-2003-0985.patch 414 MD5 de75cfa969ed092578d9ddda6c5be334 files/alpha-sources.CAN-2004-0181.patch 1233 MD5 eaeda68a619caaddd5b8fdc5e7c39932 files/alpha-sources.CAN-2004-0177.patch 384 +MD5 0f33eb1251b93d3709667faf90edad04 files/digest-alpha-sources-2.4.21-r13 304 MD5 21f3a4f186017d925067335e24db36a1 files/alpha-sources.CAN-2004-0109.patch 1877 MD5 ac42024b6e6ee1e2165914db4b22a61c files/alpha-sources.CAN-2004-0178.patch 424 MD5 082e410301c2522521b0d3843db19c9e files/alpha-sources.CAN-2004-0535.patch 502 diff --git a/sys-kernel/alpha-sources/alpha-sources-2.4.21-r12.ebuild b/sys-kernel/alpha-sources/alpha-sources-2.4.21-r13.ebuild similarity index 90% rename from sys-kernel/alpha-sources/alpha-sources-2.4.21-r12.ebuild rename to sys-kernel/alpha-sources/alpha-sources-2.4.21-r13.ebuild index acbaac22cc47..708335bd9446 100644 --- a/sys-kernel/alpha-sources/alpha-sources-2.4.21-r12.ebuild +++ b/sys-kernel/alpha-sources/alpha-sources-2.4.21-r13.ebuild @@ -1,6 +1,6 @@ # Copyright 1999-2004 Gentoo Foundation # Distributed under the terms of the GNU General Public License v2 -# $Header: /var/cvsroot/gentoo-x86/sys-kernel/alpha-sources/alpha-sources-2.4.21-r12.ebuild,v 1.1 2004/08/09 22:56:41 plasmaroo Exp $ +# $Header: /var/cvsroot/gentoo-x86/sys-kernel/alpha-sources/alpha-sources-2.4.21-r13.ebuild,v 1.1 2004/11/06 21:36:45 plasmaroo Exp $ # OKV=original kernel version, KV=patched kernel version. They can be the same. @@ -16,15 +16,16 @@ S=${WORKDIR}/linux-${KV} DESCRIPTION="Full sources for the Gentoo Linux Alpha kernel" SRC_URI="mirror://kernel/linux/kernel/v2.4/linux-${OKV}.tar.bz2 - mirror://gentoo/patches-${KV/12/3}.tar.bz2 - http://dev.gentoo.org/~plasmaroo/patches/kernel/misc/security/linux-${OKV}-CAN-2004-0415.patch" + mirror://gentoo/patches-${KV/13/3}.tar.bz2 + http://dev.gentoo.org/~plasmaroo/patches/kernel/misc/security/linux-${OKV}-CAN-2004-0415.patch + http://dev.gentoo.org/~plasmaroo/patches/kernel/misc/security/${P}-CAN-2004-0814.patch" SLOT="${KV}" KEYWORDS="alpha -sparc -x86 -ppc -hppa -mips" src_unpack() { unpack ${A} mv linux-${OKV} linux-${KV} || die - cd ${WORKDIR}/${KV/12/1} + cd ${WORKDIR}/${KV/13/1} # This is the crypt USE flag, keeps {USAGI/superfreeswan/patch-int/loop-jari} if ! use crypt; then @@ -74,9 +75,11 @@ src_unpack() { epatch ${FILESDIR}/${PN}.CAN-2004-0497.patch || die "Failed to add the CAN-2004-0497 patch!" epatch ${FILESDIR}/${PN}.CAN-2004-0535.patch || die "Failed to add the CAN-2004-0535 patch!" epatch ${FILESDIR}/${PN}.CAN-2004-0685.patch || die "Failed to add the CAN-2004-0685 patch!" + epatch ${DISTDIR}/${P}-CAN-2004-0814.patch || die "Failed to add the CAN-2004-0814 patch!" epatch ${FILESDIR}/${PN}.rtc_fix.patch || die "Failed to patch RTC vulnerabilities!" epatch ${FILESDIR}/${PN}.munmap.patch || die "Failed to apply munmap patch!" epatch ${FILESDIR}/${PN}.cmdlineLeak.patch || die "Failed to apply the /proc/cmdline patch!" + epatch ${FILESDIR}/${PN}.XDRWrapFix.patch || die "Failed to apply the kNFSd XDR fix!" # Fix multi-line literal in include/asm-alpha/xor.h -- see bug 38354 # If this script "dies" then that means it's no longer applicable. diff --git a/sys-kernel/alpha-sources/files/alpha-sources-2.4.19.rtc_fix.patch b/sys-kernel/alpha-sources/files/alpha-sources-2.4.19.rtc_fix.patch deleted file mode 100644 index 00937f83623f..000000000000 --- a/sys-kernel/alpha-sources/files/alpha-sources-2.4.19.rtc_fix.patch +++ /dev/null @@ -1,115 +0,0 @@ -diff -ur linux-2.4.20-wolk4.9s/arch/cris/drivers/ds1302.c linux-2.4.20-wolk4.9s.plasmaroo/arch/cris/drivers/ds1302.c ---- linux-2.4.20-wolk4.9s/arch/cris/drivers/ds1302.c 2004-01-05 23:33:45.000000000 +0000 -+++ linux-2.4.20-wolk4.9s.plasmaroo/arch/cris/drivers/ds1302.c 2004-01-05 23:41:44.000000000 +0000 -@@ -315,6 +315,7 @@ - { - struct rtc_time rtc_tm; - -+ memset(&rtc_tm, 0, sizeof (struct rtc_time)); - get_rtc_time(&rtc_tm); - if (copy_to_user((struct rtc_time*)arg, &rtc_tm, sizeof(struct rtc_time))) - return -EFAULT; -diff -ur linux-2.4.20-wolk4.9s/arch/m68k/bvme6000/rtc.c linux-2.4.20-wolk4.9s.plasmaroo/arch/m68k/bvme6000/rtc.c ---- linux-2.4.20-wolk4.9s/arch/m68k/bvme6000/rtc.c 2004-01-05 23:33:45.000000000 +0000 -+++ linux-2.4.20-wolk4.9s.plasmaroo/arch/m68k/bvme6000/rtc.c 2004-01-05 23:43:15.000000000 +0000 -@@ -54,6 +54,7 @@ - /* Ensure clock and real-time-mode-register are accessible */ - msr = rtc->msr & 0xc0; - rtc->msr = 0x40; -+ memset(&wtime, 0, sizeof (struct rtc_time)); - do { - wtime.tm_sec = BCD2BIN(rtc->bcd_sec); - wtime.tm_min = BCD2BIN(rtc->bcd_min); -diff -ur linux-2.4.20-wolk4.9s/arch/m68k/mvme16x/rtc.c linux-2.4.20-wolk4.9s.plasmaroo/arch/m68k/mvme16x/rtc.c ---- linux-2.4.20-wolk4.9s/arch/m68k/mvme16x/rtc.c 2004-01-05 23:33:45.000000000 +0000 -+++ linux-2.4.20-wolk4.9s.plasmaroo/arch/m68k/mvme16x/rtc.c 2004-01-05 23:44:02.000000000 +0000 -@@ -52,6 +52,7 @@ - cli(); - /* Ensure clock and real-time-mode-register are accessible */ - rtc->ctrl = RTC_READ; -+ memset(&wtime, 0, sizeof (struct rtc_time)); - wtime.tm_sec = BCD2BIN(rtc->bcd_sec); - wtime.tm_min = BCD2BIN(rtc->bcd_min); - wtime.tm_hour = BCD2BIN(rtc->bcd_hr); -diff -ur linux-2.4.20-wolk4.9s/arch/ppc64/kernel/rtc.c linux-2.4.20-wolk4.9s.plasmaroo/arch/ppc64/kernel/rtc.c ---- linux-2.4.20-wolk4.9s/arch/ppc64/kernel/rtc.c 2004-01-05 23:33:45.000000000 +0000 -+++ linux-2.4.20-wolk4.9s.plasmaroo/arch/ppc64/kernel/rtc.c 2004-01-05 23:44:34.000000000 +0000 -@@ -96,6 +96,7 @@ - switch (cmd) { - case RTC_RD_TIME: /* Read the time/date from RTC */ - { -+ memset(&wtime, 0, sizeof(struct rtc_time)); - ppc_md.get_rtc_time(&wtime); - break; - } -diff -ur linux-2.4.20-wolk4.9s/drivers/char/efirtc.c linux-2.4.20-wolk4.9s.plasmaroo/drivers/char/efirtc.c ---- linux-2.4.20-wolk4.9s/drivers/char/efirtc.c 2004-01-05 23:33:45.000000000 +0000 -+++ linux-2.4.20-wolk4.9s.plasmaroo/drivers/char/efirtc.c 2004-01-05 23:47:53.000000000 +0000 -@@ -118,6 +118,7 @@ - static void - convert_from_efi_time(efi_time_t *eft, struct rtc_time *wtime) - { -+ memset(wtime, 0, sizeof(struct rtc_time)); - wtime->tm_sec = eft->second; - wtime->tm_min = eft->minute; - wtime->tm_hour = eft->hour; -diff -ur linux-2.4.20-wolk4.9s/drivers/char/rtc.c linux-2.4.20-wolk4.9s.plasmaroo/drivers/char/rtc.c ---- linux-2.4.20-wolk4.9s/drivers/char/rtc.c 2004-01-05 23:33:45.000000000 +0000 -+++ linux-2.4.20-wolk4.9s.plasmaroo/drivers/char/rtc.c 2004-01-05 23:52:43.000000000 +0000 -@@ -370,6 +370,7 @@ - * tm_min, and tm_sec values are filled in. - */ - -+ memset(&wtime, 0, sizeof(struct rtc_time)); - get_rtc_alm_time(&wtime); - break; - } -@@ -417,6 +418,7 @@ - } - case RTC_RD_TIME: /* Read the time/date from RTC */ - { -+ memset(&wtime, 0, sizeof(struct rtc_time)); - get_rtc_time(&wtime); - break; - } -diff -ur linux-2.4.20-wolk4.9s/drivers/macintosh/rtc.c linux-2.4.20-wolk4.9s.plasmaroo/drivers/macintosh/rtc.c ---- linux-2.4.20-wolk4.9s/drivers/macintosh/rtc.c 2004-01-05 23:33:45.000000000 +0000 -+++ linux-2.4.20-wolk4.9s.plasmaroo/drivers/macintosh/rtc.c 2004-01-05 23:54:15.000000000 +0000 -@@ -64,6 +64,7 @@ - case RTC_RD_TIME: - if (ppc_md.get_rtc_time) - { -+ memset(&rtc_tm, 0, sizeof(struct rtc_time)); - get_rtc_time(&rtc_tm); - - if (copy_to_user((struct rtc_time*)arg, &rtc_tm, sizeof(struct rtc_time))) -diff -ur linux-2.4.20-wolk4.9s/drivers/sbus/char/rtc.c linux-2.4.20-wolk4.9s.plasmaroo/drivers/sbus/char/rtc.c ---- linux-2.4.20-wolk4.9s/drivers/sbus/char/rtc.c 2004-01-05 23:33:45.000000000 +0000 -+++ linux-2.4.20-wolk4.9s.plasmaroo/drivers/sbus/char/rtc.c 2004-01-05 23:54:43.000000000 +0000 -@@ -89,6 +89,7 @@ - switch (cmd) - { - case RTCGET: -+ memset(&rtc_tm, 0, sizeof(struct rtc_time)); - get_rtc_time(&rtc_tm); - - if (copy_to_user((struct rtc_time*)arg, &rtc_tm, sizeof(struct rtc_time))) -diff -ur linux-2.4.20-wolk4.9s/drivers/sgi/char/ds1286.c linux-2.4.20-wolk4.9s.plasmaroo/drivers/sgi/char/ds1286.c ---- linux-2.4.20-wolk4.9s/drivers/sgi/char/ds1286.c 2004-01-05 23:33:45.000000000 +0000 -+++ linux-2.4.20-wolk4.9s.plasmaroo/drivers/sgi/char/ds1286.c 2004-01-05 23:47:25.000000000 +0000 -@@ -174,6 +174,7 @@ - * tm_min, and tm_sec values are filled in. - */ - -+ memset(&wtime, 0, sizeof(struct rtc_time)); - ds1286_get_alm_time(&wtime); - break; - } -@@ -216,6 +217,7 @@ - } - case RTC_RD_TIME: /* Read the time/date from RTC */ - { -+ memset(&wtime, 0, sizeof(struct rtc_time)); - ds1286_get_time(&wtime); - break; - } diff --git a/sys-kernel/alpha-sources/files/alpha-sources.XDRWrapFix.patch b/sys-kernel/alpha-sources/files/alpha-sources.XDRWrapFix.patch new file mode 100644 index 000000000000..9a336ab7876a --- /dev/null +++ b/sys-kernel/alpha-sources/files/alpha-sources.XDRWrapFix.patch @@ -0,0 +1,48 @@ +# This is a BitKeeper generated diff -Nru style patch. +# +# ChangeSet +# 2004/08/16 14:50:04-03:00 neilb@cse.unsw.edu.au +# [PATCH] Fixed possibly xdr parsing error if write size exceed 2^31 +# +# xdr_argsize_check needs to cope with the possibility that the +# pointer has wrapped and could be below buf->base. +# +# Signed-off-by: Neil Brown +# +# ### Diffstat output +# ./fs/nfsd/nfs3xdr.c | 2 +- +# ./include/linux/nfsd/xdr3.h | 2 +- +# 2 files changed, 2 insertions(+), 2 deletions(-) +# +# fs/nfsd/nfs3xdr.c +# 2004/08/14 00:23:06-03:00 neilb@cse.unsw.edu.au +1 -1 +# Fixed possibly xdr parsing error if write size exceed 2^31 +# +# include/linux/nfsd/xdr3.h +# 2004/08/15 20:48:43-03:00 neilb@cse.unsw.edu.au +1 -1 +# Fixed possibly xdr parsing error if write size exceed 2^31 +# +diff -Nru a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c +--- a/fs/nfsd/nfs3xdr.c 2004-09-06 11:20:28 -07:00 ++++ b/fs/nfsd/nfs3xdr.c 2004-09-06 11:20:28 -07:00 +@@ -273,7 +273,7 @@ + { + struct svc_buf *buf = &rqstp->rq_argbuf; + +- return p - buf->base <= buf->buflen; ++ return p >= buf->base && p <= buf->base + buf->buflen ; + } + + static inline int +diff -Nru a/include/linux/nfsd/xdr3.h b/include/linux/nfsd/xdr3.h +--- a/include/linux/nfsd/xdr3.h 2004-09-06 11:20:28 -07:00 ++++ b/include/linux/nfsd/xdr3.h 2004-09-06 11:20:28 -07:00 +@@ -41,7 +41,7 @@ + __u32 count; + int stable; + __u8 * data; +- int len; ++ __u32 len; + }; + + struct nfsd3_createargs { diff --git a/sys-kernel/alpha-sources/files/digest-alpha-sources-2.4.21-r12 b/sys-kernel/alpha-sources/files/digest-alpha-sources-2.4.21-r13 similarity index 72% rename from sys-kernel/alpha-sources/files/digest-alpha-sources-2.4.21-r12 rename to sys-kernel/alpha-sources/files/digest-alpha-sources-2.4.21-r13 index 363cacc1766b..73826cbb1001 100644 --- a/sys-kernel/alpha-sources/files/digest-alpha-sources-2.4.21-r12 +++ b/sys-kernel/alpha-sources/files/digest-alpha-sources-2.4.21-r13 @@ -1,3 +1,4 @@ MD5 f51e12efa18bb828cf57d9d4a81b2fb1 linux-2.4.21.tar.bz2 28533733 MD5 28094d6a3d68f228bda98af459ad1310 patches-2.4.21-alpha-r3.tar.bz2 1696825 MD5 b48375b2731b9a99bb3697e90f170ff2 linux-2.4.21-CAN-2004-0415.patch 84284 +MD5 791ba31912926858cdf02413d87fbd6b alpha-sources-2.4.21-CAN-2004-0814.patch 81981 -- 2.26.2