Incorrect upper bound for uid and gid can result in -1 being used.
smtpd and YP/ldap situations are the most worrying.
Different fix from -current, because -stable avoids API/ABI changes.
from deraadt@
this is errata/7.9/030_uidrange.patch.sig
Incorrect upper bound for uid and gid can result in -1 being used.
smtpd and YP/ldap situations are the most worrying.
Different fix from -current, because -stable avoids API/ABI changes.
from deraadt@
this is errata/7.8/066_uidrange.patch.sig
Don't drop X509_V_ERR_HOSTNAME_MISMATCH when verify callback returns 1
While not the advised way of using the verify callback (either by OpenSSL
or by us) in production, sometimes folks like to return 1 from everything
in the callback and then check the error return and make decicions about
things.
This fix ensures that such callbacks will see the hostname mismatch and
be able to act upon them.
Reported by Alexander Aleksandrovic Klimov
from beck, ok tb@
Correct botched size check in dtls1_preprocess_fragment().
Check message length against max, rather than fragment offset and length.
Due to a various questionable code, this allows for a crafted messsage
to be sent that results in a 21MB allocation, which then promptly results
in an error. Providing that the SSL context is cleared or freed, the
[136 lines not shown]
Don't drop X509_V_ERR_HOSTNAME_MISMATCH when verify callback returns 1
While not the advised way of using the verify callback (either by OpenSSL
or by us) in production, sometimes folks like to return 1 from everything
in the callback and then check the error return and make decicions about
things.
This fix ensures that such callbacks will see the hostname mismatch and
be able to act upon them.
Reported by Alexander Aleksandrovic Klimov
from beck, ok tb@
Correct botched size check in dtls1_preprocess_fragment().
Check message length against max, rather than fragment offset and length.
Due to a various questionable code, this allows for a crafted messsage
to be sent that results in a 21MB allocation, which then promptly results
in an error. Providing that the SSL context is cleared or freed, the
[77 lines not shown]
Avoid sleeping while recording SEM_UNDO information
sys_semop(), by way of semundo_adjust() and semu_alloc(), could sleep in
pool_get(PR_WAITOK) after it had already applied the semaphore operations.
Another process can remove the set with IPC_RMID while we sleep; we then write
sempid and sem_otime through the freed semid_ds_kern and sem_base, and record
an undo entry for a set semundo_clear() has already swept, which panics
semexit() when the process exits.
This was introduced as a fallback in rev 1.14, after moving the
structures from a static array to a pool made the allocation able to
fail at all. semop(2) documents ENOSPC, so drop the fallback with the
extra complexity to work around the sleep.
semundo_adjust() must then stop freeing an emptied structure in the middle of
an operation: sys_semop()'s rollback can need it again, and re-creating it
there is allowed to fail, which is a panic. Keep it until done2. That also
takes a second sleeping pool_put() out of the done: region.
[8 lines not shown]
Avoid sleeping while recording SEM_UNDO information
sys_semop(), by way of semundo_adjust() and semu_alloc(), could sleep in
pool_get(PR_WAITOK) after it had already applied the semaphore operations.
Another process can remove the set with IPC_RMID while we sleep; we then write
sempid and sem_otime through the freed semid_ds_kern and sem_base, and record
an undo entry for a set semundo_clear() has already swept, which panics
semexit() when the process exits.
This was introduced as a fallback in rev 1.14, after moving the
structures from a static array to a pool made the allocation able to
fail at all. semop(2) documents ENOSPC, so drop the fallback with the
extra complexity to work around the sleep.
semundo_adjust() must then stop freeing an emptied structure in the middle of
an operation: sys_semop()'s rollback can need it again, and re-creating it
there is allowed to fail, which is a panic. Keep it until done2. That also
takes a second sleeping pool_put() out of the done: region.
[8 lines not shown]
In wg_bind() close IPv4 socket while failed to bind IPv6 socket with
automatic port selection.
from mvs@; From Acts1631.
this is errata/7.9/028_wgbind.patch.sig
In wg_bind() close IPv4 socket while failed to bind IPv6 socket with
automatic port selection.
from mvs@; From Acts1631.
this is errata/7.8/064_wgbind.patch.sig
iked: Reject malformed and out-of-state IKEv2 messages
A malicious or malformed IKEv2 peer could crash iked, or cause a
certificate validation verdict to be applied to the wrong peer
identity. Reject malformed DELETE payloads and EAP responses for
which no matching server state exists, and bind CA and OCSP verdicts
to the identity they were computed for.
Reported by Stefan Rinkes and acts1631kjv at proton me.
from hshoexer@; OK markus@
this is errata/7.9/027_iked.patch.sig
iked: Reject malformed and out-of-state IKEv2 messages
A malicious or malformed IKEv2 peer could crash iked, or cause a
certificate validation verdict to be applied to the wrong peer
identity. Reject malformed DELETE payloads and EAP responses for
which no matching server state exists, and bind CA and OCSP verdicts
to the identity they were computed for.
Reported by Stefan Rinkes and acts1631kjv at proton me.
from hshoexer@; OK markus@
this is errata/7.8/063_iked.patch.sig
Introduce in-kernel 'shmid_ds_kern' structure where `shm_nattch' has the
type of uint64_t. The original 'shmid_ds' used to deliver data to the
userland, so API/ABI is not broken. The delivered `shm_nattch' value is
clamped with SHRT_MAX.
from mvs@; OK deraadt@
Do missing shmid_ds_kern to shmid_ds conversion in the IPC_SET case of
sys_shmctl().
from deraadt@
the visual hint for sys_shmctl_args became incorrect with the _kernl adjustment
from deraadt@
this is errata/7.9/026_sysvipc.patch.sig
Introduce in-kernel 'shmid_ds_kern' structure where `shm_nattch' has the
type of uint64_t. The original 'shmid_ds' used to deliver data to the
userland, so API/ABI is not broken. The delivered `shm_nattch' value is
clamped with SHRT_MAX.
from mvs@; OK deraadt@
Do missing shmid_ds_kern to shmid_ds conversion in the IPC_SET case of
sys_shmctl().
from deraadt@
the visual hint for sys_shmctl_args became incorrect with the _kernl adjustment
from deraadt@
this is errata/7.8/062_sysvipc.patch.sig
In ipcs(1) use shm_cpid to determine whether a shared memory segment is in use.
As since kern_sysctl.c r1.490 shm_internal is always NULL.
from dgl@; OK deraadt@
sysctl KERN_SYSVIPC_SEM_INFO was leaking the sem_base kernel pointer to userland.
This was used by ipcs(1), so change to use sem_ctime instead to decide if it
should show the semaphore.
Found independently by me and a report from Bruce Dang of Calif.io (minutes apart).
from dgl@; OK deraadt@
this is errata/7.8/062_sysvipc.patch.sig
In sysctl KERN_PROC_ARGS "cnt" is an int, read directly from a userspace
process. The while loop has a "cnt > 0" check, but on 32-bit platforms a value
can overflow and result in the querying process having data written past the
supplied buffer. Limit the number of elements in the array to ARG_MAX.
from dgl@; OK deraadt@
this is errata/7.9/025_procargs.patch.sig
In sysctl KERN_PROC_ARGS "cnt" is an int, read directly from a userspace
process. The while loop has a "cnt > 0" check, but on 32-bit platforms a value
can overflow and result in the querying process having data written past the
supplied buffer. Limit the number of elements in the array to ARG_MAX.
from dgl@; OK deraadt@
this is errata/7.8/061_procargs.patch.sig
Sprinkle tags to be able to navigate to [no] keywords; OK schwarze
None of these were reachable by tags, e.g. ":t log" wouldn't jump to the
"log" keyword's definition because auf how auto-tagging works;
see `man -Otag=Tg mdoc' for details.
Stop using non-standard UID_MAX and GID_MAX because a variety of code
uses inclusive comparisons such that the UINT_MAX value aliases on top
of -1 and causes issues. First instance of this reported by Acts1631.
joint work with millert
Stop using non-standard UID_MAX and GID_MAX because a variety of code
uses inclusive comparisons such that the UINT_MAX value aliases on top
of -1 and causes issues. First instance of this reported by Acts1631.
joint work with millert
