Date: Tue, 17 May 2016 22:38:19 +0000 (UTC) From: Gleb Smirnoff <glebius@FreeBSD.org> To: doc-committers@freebsd.org, svn-doc-all@freebsd.org, svn-doc-head@freebsd.org Subject: svn commit: r48826 - in head/share: security/advisories security/patches/SA-16:18 security/patches/SA-16:19 xml Message-ID: <201605172238.u4HMcJU3015367@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: glebius (src committer) Date: Tue May 17 22:38:19 2016 New Revision: 48826 URL: https://svnweb.freebsd.org/changeset/doc/48826 Log: Publish SA-16:18 and SA-16:19. Added: head/share/security/advisories/FreeBSD-SA-16:18.atkbd.asc (contents, props changed) head/share/security/advisories/FreeBSD-SA-16:19.sendmsg.asc (contents, props changed) head/share/security/patches/SA-16:18/ head/share/security/patches/SA-16:18/atkbd.patch (contents, props changed) head/share/security/patches/SA-16:18/atkbd.patch.asc (contents, props changed) head/share/security/patches/SA-16:19/ head/share/security/patches/SA-16:19/sendmsg.patch (contents, props changed) head/share/security/patches/SA-16:19/sendmsg.patch.asc (contents, props changed) Modified: head/share/xml/advisories.xml Added: head/share/security/advisories/FreeBSD-SA-16:18.atkbd.asc ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/share/security/advisories/FreeBSD-SA-16:18.atkbd.asc Tue May 17 22:38:19 2016 (r48826) @@ -0,0 +1,139 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +============================================================================= +FreeBSD-SA-16:18.atkbd Security Advisory + The FreeBSD Project + +Topic: Buffer overflow in keyboard driver + +Category: core +Module: atkbd +Announced: 2016-05-17 +Credits: CTurt and the HardenedBSD team +Affects: All supported versions of FreeBSD. +Corrected: 2016-05-17 22:29:59 UTC (stable/10, 10.3-STABLE) + 2016-05-17 22:28:27 UTC (releng/10.3, 10.3-RELEASE-p3) + 2016-05-17 22:28:20 UTC (releng/10.2, 10.2-RELEASE-p17) + 2016-05-17 22:28:11 UTC (releng/10.1, 10.1-RELEASE-p34) + 2016-05-17 22:31:12 UTC (stable/9, 9.3-STABLE) + 2016-05-17 22:28:36 UTC (releng/9.3, 9.3-RELEASE-p42) +CVE Name: CVE-2016-1886 + +For general information regarding FreeBSD Security Advisories, +including descriptions of the fields above, security branches, and the +following sections, please visit <URL:https://security.FreeBSD.org/>. + +I. Background + +The atkbd(4) driver, together with the atkbdc(4) driver, provides access +to the AT 84 keyboard or the AT enhanced keyboard which is connected to +the AT keyboard controller. The driver is required for the console driver +syscons(4) or vt(4). The driver exposes its own ioctl(2) interface to allow +it to be configured from userland through the kbdcontrol(1) utility. + +II. Problem Description + +Incorrect signedness comparison in the ioctl(2) handler allows a malicious +local user to overwrite a portion of the kernel memory. + +III. Impact + +A local user may crash the kernel, read a portion of kernel memory and +execute arbitrary code in kernel context. The result of executing an +arbitrary kernel code is privilege escalation. + +IV. Workaround + +Disallow keymap changes for non-privileged users: + +sysctl hw.kbd.keymap_restrict_change=4 + +V. Solution + +Perform one of the following: + +1) Upgrade your vulnerable system to a supported FreeBSD stable or +release / security branch (releng) dated after the correction date. + +Reboot is required. + +2) To update your vulnerable system via a binary patch: + +Systems running a RELEASE version of FreeBSD on the i386 or amd64 +platforms can be updated via the freebsd-update(8) utility: + +# freebsd-update fetch +# freebsd-update install + +Reboot is required. + +3) To update your vulnerable system via a source code patch: + +The following patches have been verified to apply to the applicable +FreeBSD release branches. + +a) Download the relevant patch from the location below, and verify the +detached PGP signature using your PGP utility. + +# fetch https://security.FreeBSD.org/patches/SA-16:18/atkbd.patch +# fetch https://security.FreeBSD.org/patches/SA-16:18/atkbd.patch.asc +# gpg --verify atkbd.patch.asc + +b) Apply the patch. Execute the following commands as root: + +# cd /usr/src +# patch < /path/to/patch + +c) Recompile your kernel as described in +<URL:https://www.FreeBSD.org/handbook/kernelconfig.html>; and reboot the +system. + +VI. Correction details + +The following list contains the correction revision numbers for each +affected branch. + +Branch/path Revision +- ------------------------------------------------------------------------- +stable/9/ r300093 +releng/9.3/ r300088 +stable/10/ r300091 +releng/10.1/ r300085 +releng/10.2/ r300086 +releng/10.3/ r300087 +- ------------------------------------------------------------------------- + +To see which files were modified by a particular revision, run the +following command, replacing NNNNNN with the revision number, on a +machine with Subversion installed: + +# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base + +Or visit the following URL, replacing NNNNNN with the revision number: + +<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>; + +VII. References + +<URL:http://cturt.github.io/SETFKEY.html>; +<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1886>; + +The latest revision of this advisory is available at +<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-16:18.atkbd.asc>; +-----BEGIN PGP SIGNATURE----- + +iQIcBAEBCgAGBQJXO5z8AAoJEO1n7NZdz2rns0MQAKaUrGjGn0nkFpx/PpiM6SHv +s/Fj/z/qTXTUmimZloiQd9bkMh5wFMymozihVqoQVX2jwzPFm4Cql+Ez8ihTl9YX +s+vMgQA8mUrinebwqXHRY+bZrwbJzsvLhAepL6vrSncPBaXM37smOmVlfjyUySWZ +61L1QPhDZIYSamAMDZFx4qkdv32nWTTaE6OImQOFWY19l2tAxUMrUsTM5zSUfSas +Tq2oP4BUvI58psapMgs38UY1Bjo33E/Gd7n6FS8gUQAX1OspN1wh981oX9GHU+U1 +bHY/Ihl+rqlh3Dmxp1JBP8ma2DSLXcuhrywNpE8i/dNQA4sxXXGQyuzVk24QNXbt +cnV7F3nTqBpB9evhNFuHk0Z/z2Lg4cCaId+xSJjX8eWfvfjP8q+c9SblC2LdJg6V +D0Gt0rbUNvSikCLDI/RYY1K5pWdjvtRN6ES+YO+sk2er9Uq/ZPrNj2SfNYguRkTV +Kfwut8aQW5AQ9JTr9YGFxfqEWOzgBWutE3ysWtx6bLoROY4/vUPRBrcVDOmsiiJt +QLPdf/m8VM/NH2lQoSQ44mUXvp+BdclrhM74C7GCc0RGmdEtuoC49esNKtZ+0349 +Sm7Tj/3ZWfwN0x+DQnbnDUeRmI5zaU3o4VycmhFcm3eWQ+je8O8aCLKI/iPTKYO7 +/OVeNnLKzp5Z7naKeHct +=6GJy +-----END PGP SIGNATURE----- Added: head/share/security/advisories/FreeBSD-SA-16:19.sendmsg.asc ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/share/security/advisories/FreeBSD-SA-16:19.sendmsg.asc Tue May 17 22:38:19 2016 (r48826) @@ -0,0 +1,129 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +============================================================================= +FreeBSD-SA-16:19.sendmsg Security Advisory + The FreeBSD Project + +Topic: Incorrect argument handling in sendmsg(2) + +Category: core +Module: kernel +Announced: 2016-05-17 +Credits: CTurt and the HardenedBSD team +Affects: FreeBSD 10.x +Corrected: 2016-05-17 22:30:43 UTC (stable/10, 10.3-STABLE) + 2016-05-17 22:28:27 UTC (releng/10.3, 10.3-RELEASE-p3) + 2016-05-17 22:28:20 UTC (releng/10.2, 10.2-RELEASE-p17) + 2016-05-17 22:28:11 UTC (releng/10.1, 10.1-RELEASE-p34) +CVE Name: CVE-2016-1887 + +For general information regarding FreeBSD Security Advisories, +including descriptions of the fields above, security branches, and the +following sections, please visit <URL:https://security.FreeBSD.org/>. + +I. Background + +The sendmsg(2) system call allows to send data to a socket. The data +may be accompanied by optional ancillary data. + +II. Problem Description + +Incorrect argument handling in the socket code allows malicious local +user to overwrite large portion of the kernel memory. + +III. Impact + +Malicious local user may crash kernel or execute arbitrary code in the kernel, +potentially gaining superuser privileges. + +IV. Workaround + +No workaround is available. + +V. Solution + +Perform one of the following: + +1) Upgrade your vulnerable system to a supported FreeBSD stable or +release / security branch (releng) dated after the correction date. + +Reboot is required. + +2) To update your vulnerable system via a binary patch: + +Systems running a RELEASE version of FreeBSD on the i386 or amd64 +platforms can be updated via the freebsd-update(8) utility: + +# freebsd-update fetch +# freebsd-update install + +Reboot is required. + +3) To update your vulnerable system via a source code patch: + +The following patches have been verified to apply to the applicable +FreeBSD release branches. + +a) Download the relevant patch from the location below, and verify the +detached PGP signature using your PGP utility. + +# fetch https://security.FreeBSD.org/patches/SA-16:19/sendmsg.patch +# fetch https://security.FreeBSD.org/patches/SA-16:19/sendmsg.patch.asc +# gpg --verify sendmsg.patch.asc + +b) Apply the patch. Execute the following commands as root: + +# cd /usr/src +# patch < /path/to/patch + +c) Recompile your kernel as described in +<URL:https://www.FreeBSD.org/handbook/kernelconfig.html>; and reboot the +system. + +VI. Correction details + +The following list contains the correction revision numbers for each +affected branch. + +Branch/path Revision +- ------------------------------------------------------------------------- +stable/10/ r300093 +releng/10.1/ r300085 +releng/10.2/ r300086 +releng/10.3/ r300087 +- ------------------------------------------------------------------------- + +To see which files were modified by a particular revision, run the +following command, replacing NNNNNN with the revision number, on a +machine with Subversion installed: + +# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base + +Or visit the following URL, replacing NNNNNN with the revision number: + +<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>; + +VII. References + +<URL:http://cturt.github.io/sendmsg.html>; +<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1887>; + +The latest revision of this advisory is available at +<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-16:19.sendmsg.asc>; +-----BEGIN PGP SIGNATURE----- + +iQIcBAEBCgAGBQJXO50VAAoJEO1n7NZdz2rnWOAP/RyUks4Xf30YVGra+bHUjOsw +gFQEJ7HNNJHkkaJ5l0LpVh87YQxr7VXnlddskDRcL6MDf7IjW5bkpw+875iEFz93 +VykCN+1l84D0WlXAi9YZwg1GWoQs3SBfNpT1dtr9GuqJYAAeBfvMydJI1jHbJzJJ +7inDzgvhfPOaq8wQBfjXbUN0GgYiz6dJc3xir4+4JRw0C9sgzh1pI14o1oREJbZ0 +glmHRCpuijndqluabl7rF19mSSDyF0AV7RqDCZIt7AkYHWvR1yLl4o0LGGBYCLXx +iArz2ayzbAqBVw1JktVHzGx0HuVpobxb/yOpDuYBcaxtSL6riuSYrkzHp0Dca+JT +0/qENdMnXDN98ZMBcvVR66uWUuTVEF3/T2LXCi6G+RllrcoavvLqrcjghqT5k84P +jmAjO3Q3rIeAinjArfyexHo/f/A5CHGJylsY0FZd41A35xWaYg/dd0cT+8qsoigD +65Ix+/6AOIjocqqQToFXiHKBCN5unwrn/UT5heU0K3ZqESGmxUrx+6yJ3mjDjtLh +C7zWcNaJu1whcT7e4eKx9vMlAFFt6OrSnr1V09KnqPiHPtIu95PZhGlrizlZVELQ +8fKHoycOkT5F+00CWzcQuZK+l9p5iT5aWGkhunwvR7EKzqvgEFbDDpaJ5QzKTNTl +lJXypb8SMlol4YY8Spdo +=wuhi +-----END PGP SIGNATURE----- Added: head/share/security/patches/SA-16:18/atkbd.patch ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/share/security/patches/SA-16:18/atkbd.patch Tue May 17 22:38:19 2016 (r48826) @@ -0,0 +1,11 @@ +--- sys/dev/kbd/kbd.c.orig ++++ sys/dev/kbd/kbd.c +@@ -996,7 +996,7 @@ + splx(s); + return (error); + } +- kbd->kb_fkeytab[fkeyp->keynum].len = imin(fkeyp->flen, MAXFK); ++ kbd->kb_fkeytab[fkeyp->keynum].len = min(fkeyp->flen, MAXFK); + bcopy(fkeyp->keydef, kbd->kb_fkeytab[fkeyp->keynum].str, + kbd->kb_fkeytab[fkeyp->keynum].len); + break; Added: head/share/security/patches/SA-16:18/atkbd.patch.asc ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/share/security/patches/SA-16:18/atkbd.patch.asc Tue May 17 22:38:19 2016 (r48826) @@ -0,0 +1,16 @@ +-----BEGIN PGP SIGNATURE----- + +iQIcBAABCgAGBQJXO2BtAAoJEO1n7NZdz2rnB6kP/R2dxR6o6GemMN2VjdgOp9rM +i3DEFEcimF1oGOfwF7kIDabr9XLubeU1l+NnJhuExnAdyrcVr+7+SvgFAzv6lZlS +47wDgw/HABsjeJSYE2+hcrOAOKTvC4qObBB7YuOJu4e1vW5MJKcqBYsLk7+ECwVr +sDhelLXLcvTunR2aLg5jEsgRwHEvOwB7GR1SQ6ABU7w+emCCabJLvYe3stMYKsFE +CxL6hKDjShN0Vyqx6d76Bja6ZsWmMo2SLgz3e/m072imHfmHaAhc5GlAvdOPihzJ +OsRlIGd7jR5+mTikmWZG0s3/IVoEf+udC/CJ/3JyL3NEywQXEogJpPY2Zjv6P8or +6vWvyoIqrXrKZ5k6DxUHJzJdAhmbxZHfCVlwidu+aTfp9M8x5W7tu711wPFwAcEW +/HSQ1mssj7GEzDy2kbhKiEXTRV0YXatVy1L2o/ckYiLFMk0HhYEqFXLV36VUPIRl +h2SOUpsaLbhVuUlT+XF1jXrTc1gOW5woLl8uQ6h84cfcdQj6tUk2ZBzobKjz+zEk +VP/julLL8cGUDemnWeMLWuBClsAuf5pLMg405m1uIBd9kxEHhGKprz/kGhFfGl/3 +PyESdLIq8VD9Grjzb8rgCfL0USepeiCnOTI8uYwRNUUrAFSMqtWrx4zvl1tWdHE9 +1SBJLfQgQKuIaBAtxnHV +=Ful4 +-----END PGP SIGNATURE----- Added: head/share/security/patches/SA-16:19/sendmsg.patch ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/share/security/patches/SA-16:19/sendmsg.patch Tue May 17 22:38:19 2016 (r48826) @@ -0,0 +1,12 @@ +--- sys/kern/uipc_syscalls.c.orig ++++ sys/kern/uipc_syscalls.c +@@ -1699,6 +1699,9 @@ + struct mbuf *m; + int error; + ++ if (buflen < 0) ++ return (EINVAL); ++ + if (buflen > MLEN) { + #ifdef COMPAT_OLDSOCK + if (type == MT_SONAME && buflen <= 112) Added: head/share/security/patches/SA-16:19/sendmsg.patch.asc ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/share/security/patches/SA-16:19/sendmsg.patch.asc Tue May 17 22:38:19 2016 (r48826) @@ -0,0 +1,16 @@ +-----BEGIN PGP SIGNATURE----- + +iQIcBAABCgAGBQJXO2CNAAoJEO1n7NZdz2rnuvcP/R501Yhdfqfmw1XDYqMkKS6L +ehQwFX8rnlbZVfKEhVcZL0kGgo43jyBvuHG55vk6iwC6EjHKE6BSgUVhbRaIdfJ5 +H0gRdUL9q9inTRGLEU7P2D7E0SMsRm+PtKW5F0uw5BfZw2LD1SIBBEKGBN0M48u0 +PhTzIXzgFsvSNFbZ85Un90hi2N67hrq3rOGtxC10/jAGBpGgRGCQKqr0lssIS+6r +7QT3fEH8MQGnYW0RP26rJHh0ae0Wd0DLBdnLG0cHx6bwYEGKb6/GH65Vvl1feMAU +61O6wL3BnrSXfJQmSx34sokhh3BT7pfEEwkw3xtsdqjP6h4PXxiI2l+UlB5eGCAY +kT0eLz7qyR1vXvJUZnXezBdllUu/nWtyMmuUnoM0xnytNYeHAqDoL4o6T4lMERmy +DUn6LvrC8oqdqDKtBpaWMCq2OMb4/mNUvVdn2oh67Tq4ZFLxsGOEMm+lTYJOZdkU +um+KG7LGiWkj9G08yPiayVhDcigvIK9v9/p9E3tv5rNVyCaOvpJsezM7Z+mMIS68 +IG72BvLh+idOaVW1tib9s9nXYQTc1V9u+Fp356/eDSE1h0uEd12l+swwRcz5NmBv +78Ki51E1ZQ87b9J4RacL31MauINyN0SIJI1QRu7lLe62tgGlGKQND6/Na993EdUM +ftK8gS0awc3Rr3Bw540N +=yry1 +-----END PGP SIGNATURE----- Modified: head/share/xml/advisories.xml ============================================================================== --- head/share/xml/advisories.xml Tue May 17 21:02:25 2016 (r48825) +++ head/share/xml/advisories.xml Tue May 17 22:38:19 2016 (r48826) @@ -11,6 +11,18 @@ <name>5</name> <day> + <name>17</name> + + <advisory> + <name>FreeBSD-SA-16:19.sendmsg</name> + </advisory> + + <advisory> + <name>FreeBSD-SA-16:18.atkbd</name> + </advisory> + </day> + + <day> <name>4</name> <advisory>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201605172238.u4HMcJU3015367>