[arch-commits] Commit in linux/trunk (CVE-2013-1763.patch PKGBUILD linux.install)
Tobias Powalowski
tpowa at nymeria.archlinux.org
Mon Feb 25 11:02:32 UTC 2013
Date: Monday, February 25, 2013 @ 12:02:32
Author: tpowa
Revision: 178533
upgpkg: linux 3.8-2
fix security issue
Added:
linux/trunk/CVE-2013-1763.patch
Modified:
linux/trunk/PKGBUILD
linux/trunk/linux.install
---------------------+
CVE-2013-1763.patch | 35 +++++++++++++++++++++++++++++++++++
PKGBUILD | 18 ++++++++++++------
linux.install | 2 +-
3 files changed, 48 insertions(+), 7 deletions(-)
Added: CVE-2013-1763.patch
===================================================================
--- CVE-2013-1763.patch (rev 0)
+++ CVE-2013-1763.patch 2013-02-25 11:02:32 UTC (rev 178533)
@@ -0,0 +1,35 @@
+From 6e601a53566d84e1ffd25e7b6fe0b6894ffd79c0 Mon Sep 17 00:00:00 2001
+From: Mathias Krause <minipli at googlemail.com>
+Date: Sat, 23 Feb 2013 01:13:47 +0000
+Subject: [PATCH] sock_diag: Fix out-of-bounds access to sock_diag_handlers[]
+
+Userland can send a netlink message requesting SOCK_DIAG_BY_FAMILY
+with a family greater or equal then AF_MAX -- the array size of
+sock_diag_handlers[]. The current code does not test for this
+condition therefore is vulnerable to an out-of-bound access opening
+doors for a privilege escalation.
+
+Signed-off-by: Mathias Krause <minipli at googlemail.com>
+Acked-by: Eric Dumazet <edumazet at google.com>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+---
+ net/core/sock_diag.c | 3 +++
+ 1 files changed, 3 insertions(+), 0 deletions(-)
+
+diff --git a/net/core/sock_diag.c b/net/core/sock_diag.c
+index 602cd63..750f44f 100644
+--- a/net/core/sock_diag.c
++++ b/net/core/sock_diag.c
+@@ -121,6 +121,9 @@ static int __sock_diag_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
+ if (nlmsg_len(nlh) < sizeof(*req))
+ return -EINVAL;
+
++ if (req->sdiag_family >= AF_MAX)
++ return -EINVAL;
++
+ hndl = sock_diag_lock_handler(req->sdiag_family);
+ if (hndl == NULL)
+ err = -ENOENT;
+--
+1.7.6.5
+
Modified: PKGBUILD
===================================================================
--- PKGBUILD 2013-02-25 10:21:59 UTC (rev 178532)
+++ PKGBUILD 2013-02-25 11:02:32 UTC (rev 178533)
@@ -6,7 +6,7 @@
#pkgbase=linux-custom # Build kernel with a different name
_srcname=linux-3.8
pkgver=3.8
-pkgrel=1
+pkgrel=2
arch=('i686' 'x86_64')
url="http://www.kernel.org/"
license=('GPL2')
@@ -18,12 +18,14 @@
'config' 'config.x86_64'
# standard config files for mkinitcpio ramdisk
'linux.preset'
- 'change-default-console-loglevel.patch')
+ 'change-default-console-loglevel.patch'
+ 'CVE-2013-1763.patch')
md5sums=('1c738edfc54e7c65faeb90c436104e2f'
- '2e9010a91995b2f127ec8c26edded05d'
- '09be44e718bf96264d245f2c2892d811'
+ '9710fb1b1e08eb1fc5214dc2fb34ebcc'
+ 'b2449cb9f5335fc864fe5b0a6330265a'
'eb14dcfd80c00852ef81ded6e826826a'
- '9d3c56a4b999c8bfbd4018089a62f662')
+ '9d3c56a4b999c8bfbd4018089a62f662'
+ '420991808fe4cba143013427c0737aa9')
_kernelname=${pkgbase#linux}
@@ -36,6 +38,10 @@
# add latest fixes from stable queue, if needed
# http://git.kernel.org/?p=linux/kernel/git/stable/stable-queue.git
+ # Fix security vulnetability CVE-2013-1763.patch
+ # https://bugs.archlinux.org/task/34005
+ patch -Np1 -i "${srcdir}/CVE-2013-1763.patch"
+
# set DEFAULT_CONSOLE_LOGLEVEL to 4 (same value as the 'quiet' kernel param)
# remove this when a Kconfig knob is made available by upstream
# (relevant patch sent upstream: https://lkml.org/lkml/2011/7/26/227)
@@ -171,7 +177,7 @@
mkdir -p "${pkgdir}/usr/src/linux-${_kernver}/include"
- for i in acpi asm-generic config crypto drm generated linux math-emu \
+ for i in acpi asm-generic config crypto drm generated keys linux math-emu \
media net pcmcia scsi sound trace uapi video xen; do
cp -a include/${i} "${pkgdir}/usr/src/linux-${_kernver}/include/"
done
Modified: linux.install
===================================================================
--- linux.install 2013-02-25 10:21:59 UTC (rev 178532)
+++ linux.install 2013-02-25 11:02:32 UTC (rev 178533)
@@ -2,7 +2,7 @@
# arg 2: the old package version
KERNEL_NAME=
-KERNEL_VERSION=3.8.0-1-ARCH
+KERNEL_VERSION=3.8.0-2-ARCH
# set a sane PATH to ensure that critical utils like depmod will be found
export PATH='/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'
More information about the arch-commits
mailing list