From f8fc3f01775bc8277c4e305c2b3ff3968a2f13ba Mon Sep 17 00:00:00 2001 From: Tim Yamin Date: Sat, 27 Nov 2004 18:25:13 +0000 Subject: [PATCH] Version bump for the AF_UNIX and a.out security vulnerabilities; bugs #72452 and #72317. --- sys-kernel/uclinux-sources/ChangeLog | 13 +++- sys-kernel/uclinux-sources/Manifest | 13 ++-- ...9 => digest-uclinux-sources-2.4.26_p0-r10} | 0 ...r9 => digest-uclinux-sources-2.6.7_p0-r10} | 0 ...linux-sources-2.4.26_p0.binfmt_a.out.patch | 63 +++++++++++++++++++ .../uclinux-sources-2.6.binfmt_a.out.patch | 63 +++++++++++++++++++ .../files/uclinux-sources.AF_UNIX.patch | 24 +++++++ ...d => uclinux-sources-2.4.26_p0-r10.ebuild} | 4 +- ...ld => uclinux-sources-2.6.7_p0-r10.ebuild} | 4 +- 9 files changed, 176 insertions(+), 8 deletions(-) rename sys-kernel/uclinux-sources/files/{digest-uclinux-sources-2.4.26_p0-r9 => digest-uclinux-sources-2.4.26_p0-r10} (100%) rename sys-kernel/uclinux-sources/files/{digest-uclinux-sources-2.6.7_p0-r9 => digest-uclinux-sources-2.6.7_p0-r10} (100%) create mode 100644 sys-kernel/uclinux-sources/files/uclinux-sources-2.4.26_p0.binfmt_a.out.patch create mode 100644 sys-kernel/uclinux-sources/files/uclinux-sources-2.6.binfmt_a.out.patch create mode 100644 sys-kernel/uclinux-sources/files/uclinux-sources.AF_UNIX.patch rename sys-kernel/uclinux-sources/{uclinux-sources-2.4.26_p0-r9.ebuild => uclinux-sources-2.4.26_p0-r10.ebuild} (90%) rename sys-kernel/uclinux-sources/{uclinux-sources-2.6.7_p0-r9.ebuild => uclinux-sources-2.6.7_p0-r10.ebuild} (90%) diff --git a/sys-kernel/uclinux-sources/ChangeLog b/sys-kernel/uclinux-sources/ChangeLog index 579860452982..509ba29bb66c 100644 --- a/sys-kernel/uclinux-sources/ChangeLog +++ b/sys-kernel/uclinux-sources/ChangeLog @@ -1,6 +1,17 @@ # ChangeLog for sys-kernel/uclinux-sources # Copyright 2000-2004 Gentoo Foundation; Distributed under the GPL v2 -# $Header: /var/cvsroot/gentoo-x86/sys-kernel/uclinux-sources/ChangeLog,v 1.22 2004/11/20 11:26:08 plasmaroo Exp $ +# $Header: /var/cvsroot/gentoo-x86/sys-kernel/uclinux-sources/ChangeLog,v 1.23 2004/11/27 18:25:13 plasmaroo Exp $ + +*uclinux-sources-2.6.7_p0-r10 (27 Nov 2004) + + 27 Nov 2004; +uclinux-sources-2.4.26_p0-r10.ebuild, + -uclinux-sources-2.4.26_p0-r9.ebuild, +uclinux-sources-2.6.7_p0-r10.ebuild, + -uclinux-sources-2.6.7_p0-r9.ebuild, + +files/uclinux-sources-2.4.26_p0.binfmt_a.out.patch, + +files/uclinux-sources-2.6.binfmt_a.out.patch, + +files/uclinux-sources.AF_UNIX.patch: + Version bump for the AF_UNIX and a.out security vulnerabilities; bugs #72452 + and #72317. *uclinux-sources-2.4.26_p0-r9 (20 Nov 2004) diff --git a/sys-kernel/uclinux-sources/Manifest b/sys-kernel/uclinux-sources/Manifest index 0dcb4e33eb12..437ac43bac84 100644 --- a/sys-kernel/uclinux-sources/Manifest +++ b/sys-kernel/uclinux-sources/Manifest @@ -1,24 +1,27 @@ -MD5 ded5ae6571b56f8a44bf64f2cbd76bc3 ChangeLog 6811 +MD5 9d2d6c0f5eb08135656ee1cd40113a70 ChangeLog 7288 MD5 f3fa6c474b8727f8215534b7fc9c93ba metadata.xml 304 -MD5 1ff3771f304594e23416d603bec77967 uclinux-sources-2.4.26_p0-r9.ebuild 2566 -MD5 c57f92e3e069a61d4c25b625ca0e17cf uclinux-sources-2.6.7_p0-r9.ebuild 2525 +MD5 e208a10aedd87d6614072a2e60d04ddb uclinux-sources-2.4.26_p0-r10.ebuild 2737 +MD5 c2c883dd52481b115722a81187d5e7b6 uclinux-sources-2.6.7_p0-r10.ebuild 2701 MD5 2b3ddb8b8b15f8da35ade38544b57857 files/uclinux-sources-2.4.26_p0.XDRWrapFix.patch 1499 MD5 dc18e982f8149588a291956481885a8c files/uclinux-sources-2.4.26_p0.CAN-2004-0495.patch 17549 MD5 c2510fe1891f5a9effb12c2196922206 files/uclinux-sources-2.6.cmdlineLeak.patch 281 +MD5 025c80544aef14ce3a49024d791c5596 files/uclinux-sources-2.6.binfmt_a.out.patch 1763 +MD5 b9a94233e1457787352e5f85e3e3582d files/uclinux-sources-2.4.26_p0.binfmt_a.out.patch 2009 MD5 60d25ff310fc6abfdce39ec9e47345af files/uclinux-sources-2.4.26_p0.CAN-2004-0685.patch 2809 MD5 d4a740ae56c2049247083af387a22a85 files/uclinux-sources-2.4.26_p0.CAN-2004-0394.patch 350 MD5 1e1fe7bb98c80db4644f4b7fd7dd5d32 files/uclinux-sources-2.4.26_p0.smbfs.patch 3434 MD5 a9991d6324d7404ed99e79be6e44e9de files/uclinux-sources-2.6.binfmt_elf.patch 2348 -MD5 e9ac5dab071a88dca4c7765abdc4c6dd files/digest-uclinux-sources-2.6.7_p0-r9 287 MD5 915e8d7a0618736caa44d96968015467 files/uclinux-sources-2.4.26_p0.binfmt_elf.patch 2346 MD5 0f66013f643c79c97fda489618a4e2fd files/uclinux-sources-2.4.26_p0.CAN-2004-0535.patch 476 MD5 95708646470a95668e8789cd415844ed files/uclinux-sources.CAN-2004-0497.patch 846 +MD5 e9ac5dab071a88dca4c7765abdc4c6dd files/digest-uclinux-sources-2.6.7_p0-r10 287 MD5 c9da1bc82b906f6abc648c056e7bf662 files/uclinux-sources-2.4.26_p0.FPULockup-53804.patch 354 MD5 39361f8d16b1fe5891aab62e92f8cd30 files/uclinux-sources-2.6.IPTables-RDoS.patch 390 MD5 aa595005721b58929ee55e2e8f4b6ba0 files/uclinux-sources-2.6.CAN-2004-0816.patch 1693 MD5 8165de5e2ab6e0d3263ea35ce856fd1b files/uclinux-sources-2.6.smbfs.patch 3309 MD5 452e04a312368605e145428c35bd0e05 files/uclinux-sources-2.6.devPtmx.patch 572 MD5 b738cb0120a32aa92cfcfdbd564dd21f files/uclinux-sources-2.6.ProcPerms.patch 1368 +MD5 d306514f5f3dc06853daf8c3e60d01c9 files/digest-uclinux-sources-2.4.26_p0-r10 301 MD5 8204afea1d572b49a4a80d8da4eef0c9 files/uclinux-sources-2.6.CAN-2004-0596.patch 1033 -MD5 d306514f5f3dc06853daf8c3e60d01c9 files/digest-uclinux-sources-2.4.26_p0-r9 301 +MD5 b0a1f80aff51d6601e8924329023b241 files/uclinux-sources.AF_UNIX.patch 515 MD5 d1ccc2047be533c992f67270a150a210 files/uclinux-sources-2.4.26_p0.cmdlineLeak.patch 388 diff --git a/sys-kernel/uclinux-sources/files/digest-uclinux-sources-2.4.26_p0-r9 b/sys-kernel/uclinux-sources/files/digest-uclinux-sources-2.4.26_p0-r10 similarity index 100% rename from sys-kernel/uclinux-sources/files/digest-uclinux-sources-2.4.26_p0-r9 rename to sys-kernel/uclinux-sources/files/digest-uclinux-sources-2.4.26_p0-r10 diff --git a/sys-kernel/uclinux-sources/files/digest-uclinux-sources-2.6.7_p0-r9 b/sys-kernel/uclinux-sources/files/digest-uclinux-sources-2.6.7_p0-r10 similarity index 100% rename from sys-kernel/uclinux-sources/files/digest-uclinux-sources-2.6.7_p0-r9 rename to sys-kernel/uclinux-sources/files/digest-uclinux-sources-2.6.7_p0-r10 diff --git a/sys-kernel/uclinux-sources/files/uclinux-sources-2.4.26_p0.binfmt_a.out.patch b/sys-kernel/uclinux-sources/files/uclinux-sources-2.4.26_p0.binfmt_a.out.patch new file mode 100644 index 000000000000..4644ae28bce4 --- /dev/null +++ b/sys-kernel/uclinux-sources/files/uclinux-sources-2.4.26_p0.binfmt_a.out.patch @@ -0,0 +1,63 @@ +diff -Nru linux-2.4.28/fs/exec.c linux-2.4.28.plasmaroo/fs/exec.c +--- linux-2.4.28/fs/exec.c 2004-04-15 10:44:45 -07:00 ++++ linux-2.4.28.plasmaroo/fs/exec.c 2004-11-12 12:02:40 -08:00 +@@ -342,6 +342,7 @@ int setup_arg_pages(struct linux_binprm + + down_write(¤t->mm->mmap_sem); + { ++ struct vm_area_struct *vma; + mpnt->vm_mm = current->mm; + mpnt->vm_start = PAGE_MASK & (unsigned long) bprm->p; + mpnt->vm_end = STACK_TOP; +@@ -351,6 +352,12 @@ int setup_arg_pages(struct linux_binprm + mpnt->vm_pgoff = 0; + mpnt->vm_file = NULL; + mpnt->vm_private_data = (void *) 0; ++ vma = find_vma(current->mm, mpnt->vm_start); ++ if (vma) { ++ up_write(¤t->mm->mmap_sem); ++ kmem_cache_free(vm_area_cachep, mpnt); ++ return -ENOMEM; ++ } + insert_vm_struct(current->mm, mpnt); + current->mm->total_vm = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT; + } +diff -Nru linux-2.4.28/fs/exec.c linux-2.4.28.plasmaroo/fs/exec.c +--- linux-2.4.28/fs/binfmt_aout.c 2002-02-04 23:54:04 -08:00 ++++ linux-2.4.28.plasmaroo/fs/binfmt_aout.c 2004-11-12 11:55:14 -08:00 +@@ -39,13 +39,18 @@ static struct linux_binfmt aout_format = + NULL, THIS_MODULE, load_aout_binary, load_aout_library, aout_core_dump, PAGE_SIZE + }; + +-static void set_brk(unsigned long start, unsigned long end) ++#define BAD_ADDR(x) ((unsigned long)(x) >= TASK_SIZE) ++ ++static int set_brk(unsigned long start, unsigned long end) + { + start = PAGE_ALIGN(start); + end = PAGE_ALIGN(end); +- if (end <= start) +- return; +- do_brk(start, end - start); ++ if (end > start) { ++ unsigned long addr = do_brk(start, end - start); ++ if (BAD_ADDR(addr)) ++ return addr; ++ } ++ return 0; + } + + /* +@@ -405,7 +410,11 @@ static int load_aout_binary(struct linux + beyond_if: + set_binfmt(&aout_format); + +- set_brk(current->mm->start_brk, current->mm->brk); ++ retval = set_brk(current->mm->start_brk, current->mm->brk); ++ if (retval < 0) { ++ send_sig(SIGKILL, current, 0); ++ return retval; ++ } + + retval = setup_arg_pages(bprm); + if (retval < 0) { diff --git a/sys-kernel/uclinux-sources/files/uclinux-sources-2.6.binfmt_a.out.patch b/sys-kernel/uclinux-sources/files/uclinux-sources-2.6.binfmt_a.out.patch new file mode 100644 index 000000000000..89665ce8db42 --- /dev/null +++ b/sys-kernel/uclinux-sources/files/uclinux-sources-2.6.binfmt_a.out.patch @@ -0,0 +1,63 @@ +diff -Nru linux-2.6.9/fs/exec.c linux-2.6.9.plasmaroo/fs/exec.c +--- linux-2.6.9/fs/exec.c 2004-11-27 08:30:03 -08:00 ++++ linux-2.6.9.plasmaroo/fs/exec.c 2004-11-27 08:30:03 -08:00 +@@ -413,6 +413,7 @@ + + down_write(&mm->mmap_sem); + { ++ struct vm_area_struct *vma; + mpnt->vm_mm = mm; + #ifdef CONFIG_STACK_GROWSUP + mpnt->vm_start = stack_base; +@@ -433,6 +434,12 @@ + mpnt->vm_flags = VM_STACK_FLAGS; + mpnt->vm_flags |= mm->def_flags; + mpnt->vm_page_prot = protection_map[mpnt->vm_flags & 0x7]; ++ vma = find_vma(mm, mpnt->vm_start); ++ if (vma) { ++ up_write(&mm->mmap_sem); ++ kmem_cache_free(vm_area_cachep, mpnt); ++ return -ENOMEM; ++ } + insert_vm_struct(mm, mpnt); + mm->stack_vm = mm->total_vm = vma_pages(mpnt); + } +diff -Nru linux-2.6.9/fs/binfmt_aout.c linux-2.6.9.plasmaroo/fs/binfmt_aout.c +--- linux-2.6.9/fs/binfmt_aout.c 2004-11-27 08:31:43 -08:00 ++++ linux-2.6.9.plasmaroo/fs/binfmt_aout.c 2004-11-27 08:31:43 -08:00 +@@ -43,13 +43,18 @@ + .min_coredump = PAGE_SIZE + }; + +-static void set_brk(unsigned long start, unsigned long end) ++#define BAD_ADDR(x) ((unsigned long)(x) >= TASK_SIZE) ++ ++static int set_brk(unsigned long start, unsigned long end) + { + start = PAGE_ALIGN(start); + end = PAGE_ALIGN(end); +- if (end <= start) +- return; +- do_brk(start, end - start); ++ if (end > start) { ++ unsigned long addr = do_brk(start, end - start); ++ if (BAD_ADDR(addr)) ++ return addr; ++ } ++ return 0; + } + + /* +@@ -413,7 +418,11 @@ + beyond_if: + set_binfmt(&aout_format); + +- set_brk(current->mm->start_brk, current->mm->brk); ++ retval = set_brk(current->mm->start_brk, current->mm->brk); ++ if (retval < 0) { ++ send_sig(SIGKILL, current, 0); ++ return retval; ++ } + + retval = setup_arg_pages(bprm, EXSTACK_DEFAULT); + if (retval < 0) { diff --git a/sys-kernel/uclinux-sources/files/uclinux-sources.AF_UNIX.patch b/sys-kernel/uclinux-sources/files/uclinux-sources.AF_UNIX.patch new file mode 100644 index 000000000000..6ced78404a2d --- /dev/null +++ b/sys-kernel/uclinux-sources/files/uclinux-sources.AF_UNIX.patch @@ -0,0 +1,24 @@ +--- linux-2.4.27/net/unix/af_unix.c 2004-11-24 08:23:21 -08:00 ++++ linux-2.4.28/net/unix/af_unix.c 2004-11-24 08:23:21 -08:00 +@@ -1403,9 +1403,11 @@ + + msg->msg_namelen = 0; + ++ down(&sk->protinfo.af_unix.readsem); ++ + skb = skb_recv_datagram(sk, flags, noblock, &err); + if (!skb) +- goto out; ++ goto out_unlock; + + wake_up_interruptible(&sk->protinfo.af_unix.peer_wait); + +@@ -1449,6 +1451,8 @@ + + out_free: + skb_free_datagram(sk,skb); ++out_unlock: ++ up(&sk->protinfo.af_unix.readsem); + out: + return err; + } diff --git a/sys-kernel/uclinux-sources/uclinux-sources-2.4.26_p0-r9.ebuild b/sys-kernel/uclinux-sources/uclinux-sources-2.4.26_p0-r10.ebuild similarity index 90% rename from sys-kernel/uclinux-sources/uclinux-sources-2.4.26_p0-r9.ebuild rename to sys-kernel/uclinux-sources/uclinux-sources-2.4.26_p0-r10.ebuild index edbe57424db4..b0d81b4d50cb 100644 --- a/sys-kernel/uclinux-sources/uclinux-sources-2.4.26_p0-r9.ebuild +++ b/sys-kernel/uclinux-sources/uclinux-sources-2.4.26_p0-r10.ebuild @@ -1,6 +1,6 @@ # Copyright 1999-2004 Gentoo Foundation # Distributed under the terms of the GNU General Public License v2 -# $Header: /var/cvsroot/gentoo-x86/sys-kernel/uclinux-sources/uclinux-sources-2.4.26_p0-r9.ebuild,v 1.1 2004/11/20 11:26:08 plasmaroo Exp $ +# $Header: /var/cvsroot/gentoo-x86/sys-kernel/uclinux-sources/uclinux-sources-2.4.26_p0-r10.ebuild,v 1.1 2004/11/27 18:25:13 plasmaroo Exp $ IUSE="" @@ -59,6 +59,8 @@ src_unpack() { epatch ${FILESDIR}/${P}.XDRWrapFix.patch || die "Failed to apply the kNFSd XDR patch!" epatch ${FILESDIR}/${P}.binfmt_elf.patch || die "Failed to apply the binfmt_elf patch!" epatch ${FILESDIR}/${P}.smbfs.patch || die "Failed to apply the SMBFS patch!" + epatch ${FILESDIR}/${PN}.AF_UNIX.patch || die "Failed to apply the AF_UNIX patch!" + epatch ${FILESDIR}/${P}.binfmt_a.out.patch || die "Failed to apply the a.out patch!" kernel_universal_unpack set ARCH=${MY_ARCH} diff --git a/sys-kernel/uclinux-sources/uclinux-sources-2.6.7_p0-r9.ebuild b/sys-kernel/uclinux-sources/uclinux-sources-2.6.7_p0-r10.ebuild similarity index 90% rename from sys-kernel/uclinux-sources/uclinux-sources-2.6.7_p0-r9.ebuild rename to sys-kernel/uclinux-sources/uclinux-sources-2.6.7_p0-r10.ebuild index 786f0ed11fd0..b8530ac0160c 100644 --- a/sys-kernel/uclinux-sources/uclinux-sources-2.6.7_p0-r9.ebuild +++ b/sys-kernel/uclinux-sources/uclinux-sources-2.6.7_p0-r10.ebuild @@ -1,6 +1,6 @@ # Copyright 1999-2004 Gentoo Foundation # Distributed under the terms of the GNU General Public License v2 -# $Header: /var/cvsroot/gentoo-x86/sys-kernel/uclinux-sources/uclinux-sources-2.6.7_p0-r9.ebuild,v 1.1 2004/11/20 11:26:08 plasmaroo Exp $ +# $Header: /var/cvsroot/gentoo-x86/sys-kernel/uclinux-sources/uclinux-sources-2.6.7_p0-r10.ebuild,v 1.1 2004/11/27 18:25:13 plasmaroo Exp $ IUSE="" @@ -52,6 +52,8 @@ src_unpack() { epatch ${FILESDIR}/${PN}-2.6.devPtmx.patch || die "Failed to apply /dev/ptmx patch!" epatch ${FILESDIR}/${PN}-2.6.binfmt_elf.patch || die "Failed to apply binfmt_elf patch!" epatch ${FILESDIR}/${PN}-2.6.smbfs.patch || die "Failed to apply SMBFS patch!" + epatch ${FILESDIR}/${PN}.AF_UNIX.patch || die "Failed to apply the AF_UNIX patch!" + epatch ${FILESDIR}/${PN}-2.6.binfmt_a.out.patch || die "Failed to apply the a.out patch!" set MY_ARCH=${ARCH} unset ARCH -- 2.26.2