summaryrefslogtreecommitdiff
path: root/kernels/linux-libre-pae
diff options
context:
space:
mode:
authorroot <root@rshg054.dnsready.net>2013-02-26 00:04:24 -0800
committerroot <root@rshg054.dnsready.net>2013-02-26 00:04:24 -0800
commit6c56414fe7bf470adb65cbd5ece3dce77ea9c617 (patch)
tree4190641f9a1d00a142902d10b7fbc068751e3821 /kernels/linux-libre-pae
parent099ae9e11de65606b67c6344d4f62fcd74f20a36 (diff)
Tue Feb 26 00:04:24 PST 2013
Diffstat (limited to 'kernels/linux-libre-pae')
-rw-r--r--kernels/linux-libre-pae/CVE-2013-1763.patch35
-rw-r--r--kernels/linux-libre-pae/PKGBUILD16
-rw-r--r--kernels/linux-libre-pae/linux-libre-pae.install2
3 files changed, 47 insertions, 6 deletions
diff --git a/kernels/linux-libre-pae/CVE-2013-1763.patch b/kernels/linux-libre-pae/CVE-2013-1763.patch
new file mode 100644
index 000000000..82b59a6dc
--- /dev/null
+++ b/kernels/linux-libre-pae/CVE-2013-1763.patch
@@ -0,0 +1,35 @@
+From 6e601a53566d84e1ffd25e7b6fe0b6894ffd79c0 Mon Sep 17 00:00:00 2001
+From: Mathias Krause <minipli@googlemail.com>
+Date: Sat, 23 Feb 2013 01:13:47 +0000
+Subject: [PATCH] sock_diag: Fix out-of-bounds access to sock_diag_handlers[]
+
+Userland can send a netlink message requesting SOCK_DIAG_BY_FAMILY
+with a family greater or equal then AF_MAX -- the array size of
+sock_diag_handlers[]. The current code does not test for this
+condition therefore is vulnerable to an out-of-bound access opening
+doors for a privilege escalation.
+
+Signed-off-by: Mathias Krause <minipli@googlemail.com>
+Acked-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ net/core/sock_diag.c | 3 +++
+ 1 files changed, 3 insertions(+), 0 deletions(-)
+
+diff --git a/net/core/sock_diag.c b/net/core/sock_diag.c
+index 602cd63..750f44f 100644
+--- a/net/core/sock_diag.c
++++ b/net/core/sock_diag.c
+@@ -121,6 +121,9 @@ static int __sock_diag_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
+ if (nlmsg_len(nlh) < sizeof(*req))
+ return -EINVAL;
+
++ if (req->sdiag_family >= AF_MAX)
++ return -EINVAL;
++
+ hndl = sock_diag_lock_handler(req->sdiag_family);
+ if (hndl == NULL)
+ err = -ENOENT;
+--
+1.7.6.5
+
diff --git a/kernels/linux-libre-pae/PKGBUILD b/kernels/linux-libre-pae/PKGBUILD
index b5fa1ce58..6f0c91586 100644
--- a/kernels/linux-libre-pae/PKGBUILD
+++ b/kernels/linux-libre-pae/PKGBUILD
@@ -1,4 +1,4 @@
-# $Id: PKGBUILD 178342 2013-02-20 12:32:29Z tpowa $
+# $Id: PKGBUILD 178533 2013-02-25 11:02:32Z tpowa $
# Contributor: Tobias Powalowski <tpowa@archlinux.org>
# Contributor: Thomas Baechler <thomas@archlinux.org>
# Maintainer (Parabola): André Silva <emulatorman@lavabit.com>
@@ -8,7 +8,7 @@ pkgbase=linux-libre-pae # Build stock -LIBRE-PAE kernel
_basekernel=3.8
#pkgver=${_basekernel}.9
pkgver=${_basekernel}
-pkgrel=1
+pkgrel=2
arch=('i686')
url="http://linux-libre.fsfla.org/"
license=('GPL2')
@@ -21,12 +21,14 @@ source=("http://linux-libre.fsfla.org/pub/linux-libre/releases/${_basekernel}-gn
# standard config files for mkinitcpio ramdisk
"${pkgbase}.preset"
'boot-logo.patch'
- 'change-default-console-loglevel.patch')
+ 'change-default-console-loglevel.patch'
+ 'CVE-2013-1763.patch')
md5sums=('84c2a77910932ffc7d958744ac9cf2f5'
'01e97ae92b25fa9d004ff589c7f56703'
'f302c931bd85309da9d9792b4cc96467'
'04b21c79df0a952c22d681dd4f4562df'
- '9d3c56a4b999c8bfbd4018089a62f662')
+ '9d3c56a4b999c8bfbd4018089a62f662'
+ '420991808fe4cba143013427c0737aa9')
_kernelname=${pkgbase#linux-libre}
_localversionname=-LIBRE-PAE
@@ -41,6 +43,10 @@ build() {
# Add freedo as boot logo
patch -Np1 -i "${srcdir}/boot-logo.patch"
+ # Fix security vulnetability CVE-2013-1763.patch
+ # https://bugs.archlinux.org/task/34005
+ patch -Np1 -i "${srcdir}/CVE-2013-1763.patch"
+
# set DEFAULT_CONSOLE_LOGLEVEL to 4 (same value as the 'quiet' kernel param)
# remove this when a Kconfig knob is made available by upstream
# (relevant patch sent upstream: https://lkml.org/lkml/2011/7/26/227)
@@ -168,7 +174,7 @@ _package-headers() {
mkdir -p "${pkgdir}/usr/src/linux-${_kernver}/include"
- for i in acpi asm-generic config crypto drm generated linux math-emu \
+ for i in acpi asm-generic config crypto drm generated keys linux math-emu \
media net pcmcia scsi sound trace uapi video xen; do
cp -a include/${i} "${pkgdir}/usr/src/linux-${_kernver}/include/"
done
diff --git a/kernels/linux-libre-pae/linux-libre-pae.install b/kernels/linux-libre-pae/linux-libre-pae.install
index 8810c28e5..4a41ea6bb 100644
--- a/kernels/linux-libre-pae/linux-libre-pae.install
+++ b/kernels/linux-libre-pae/linux-libre-pae.install
@@ -2,7 +2,7 @@
# arg 2: the old package version
KERNEL_NAME=-pae
-KERNEL_VERSION=3.8.0-1-LIBRE-PAE
+KERNEL_VERSION=3.8.0-2-LIBRE-PAE
# set a sane PATH to ensure that critical utils like depmod will be found
export PATH='/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'