git: fb32d2e2a0 - main - Add EN-22:16 to EN-22:19 and SA-22:09 to SA-22:12.
Gordon Tetlow <[email protected]>
| Newsgroups | gmane.os.freebsd.devel.cvs.doc |
|---|---|
| Message-ID | <[email protected]> |
The branch main has been updated by gordon (src committer): URL: https://cgit.FreeBSD.org/doc/commit/?id=fb32d2e2a06a845b478bed26c3355ea013304a5a commit fb32d2e2a06a845b478bed26c3355ea013304a5a Author: Gordon Tetlow <[email protected]> AuthorDate: 2022-08-09 21:22:54 +0000 Commit: Gordon Tetlow <[email protected]> CommitDate: 2022-08-09 21:22:54 +0000 Add EN-22:16 to EN-22:19 and SA-22:09 to SA-22:12. Approved by: so --- website/data/security/advisories.toml | 16 +++ website/data/security/errata.toml | 16 +++ .../advisories/FreeBSD-EN-22:16.kqueue.asc | 127 +++++++++++++++++ .../security/advisories/FreeBSD-EN-22:17.cam.asc | 151 ++++++++++++++++++++ .../security/advisories/FreeBSD-EN-22:18.wifi.asc | 130 +++++++++++++++++ .../advisories/FreeBSD-EN-22:19.pam_exec.asc | 132 +++++++++++++++++ .../security/advisories/FreeBSD-SA-22:09.elf.asc | 156 +++++++++++++++++++++ .../security/advisories/FreeBSD-SA-22:10.aio.asc | 151 ++++++++++++++++++++ .../security/advisories/FreeBSD-SA-22:11.vm.asc | 149 ++++++++++++++++++++ .../security/advisories/FreeBSD-SA-22:12.lib9p.asc | 136 ++++++++++++++++++ .../static/security/patches/EN-22:16/kqueue.patch | 11 ++ .../security/patches/EN-22:16/kqueue.patch.asc | 16 +++ website/static/security/patches/EN-22:17/cam.patch | 10 ++ .../static/security/patches/EN-22:17/cam.patch.asc | 16 +++ .../static/security/patches/EN-22:18/wifi.patch | 22 +++ .../security/patches/EN-22:18/wifi.patch.asc | 16 +++ .../security/patches/EN-22:19/pam_exec.patch | 16 +++ .../security/patches/EN-22:19/pam_exec.patch.asc | 16 +++ website/static/security/patches/SA-22:09/elf.patch | 23 +++ .../static/security/patches/SA-22:09/elf.patch.asc | 16 +++ .../static/security/patches/SA-22:10/aio.12.patch | 20 +++ .../security/patches/SA-22:10/aio.12.patch.asc | 16 +++ .../static/security/patches/SA-22:10/aio.13.patch | 20 +++ .../security/patches/SA-22:10/aio.13.patch.asc | 16 +++ website/static/security/patches/SA-22:11/vm.patch | 16 +++ .../static/security/patches/SA-22:11/vm.patch.asc | 16 +++ .../static/security/patches/SA-22:12/lib9p.patch | 27 ++++ .../security/patches/SA-22:12/lib9p.patch.asc | 16 +++ 28 files changed, 1473 insertions(+) diff --git a/website/data/security/advisories.toml b/website/data/security/advisories.toml index 78389d84e8..49a8244da2 100644 --- a/website/data/security/advisories.toml +++ b/website/data/security/advisories.toml @@ -1,6 +1,22 @@ # Sort advisories by year, month and day # $FreeBSD$ +[[advisories]] +name = "FreeBSD-SA-22:12.lib9p" +date = "2022-08-09" + +[[advisories]] +name = "FreeBSD-SA-22:11.vm" +date = "2022-08-09" + +[[advisories]] +name = "FreeBSD-SA-22:10.aio" +date = "2022-08-09" + +[[advisories]] +name = "FreeBSD-SA-22:09.elf" +date = "2022-08-09" + [[advisories]] name = "FreeBSD-SA-22:08.zlib" date = "2022-04-06" diff --git a/website/data/security/errata.toml b/website/data/security/errata.toml index 04aeec64c2..d8b7dd74be 100644 --- a/website/data/security/errata.toml +++ b/website/data/security/errata.toml @@ -1,6 +1,22 @@ # Sort errata notices by year, month and day # $FreeBSD$ +[[notices]] +name = "FreeBSD-EN-22:19.pam_exec" +date = "2022-08-09" + +[[notices]] +name = "FreeBSD-EN-22:18.wifi" +date = "2022-08-09" + +[[notices]] +name = "FreeBSD-EN-22:17.cam" +date = "2022-08-09" + +[[notices]] +name = "FreeBSD-EN-22:16.kqueue" +date = "2022-08-09" + [[notices]] name = "FreeBSD-EN-22:15.pf" date = "2022-04-06" diff --git a/website/static/security/advisories/FreeBSD-EN-22:16.kqueue.asc b/website/static/security/advisories/FreeBSD-EN-22:16.kqueue.asc new file mode 100644 index 0000000000..4e925763bd --- /dev/null +++ b/website/static/security/advisories/FreeBSD-EN-22:16.kqueue.asc @@ -0,0 +1,127 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +============================================================================= +FreeBSD-EN-22:16.kqueue Errata Notice + The FreeBSD Project + +Topic: kevent(2) timers fire too often + +Category: core +Module: kqueue +Announced: 2022-08-09 +Affects: FreeBSD 13.1 +Corrected: 2022-06-08 00:42:21 UTC (stable/13, 13.1-STABLE) + 2022-08-09 20:01:21 UTC (releng/13.1, 13.1-RELEASE-p1) + +For general information regarding FreeBSD Errata Notices and Security +Advisories, including descriptions of the fields above, security +branches, and the following sections, please visit +<URL:https://security.FreeBSD.org/>. + +I. Background + +kevent(2) is a system call which provides a generic method of notifying +the caller when a caller-specified event happens or a condition holds. +One use for kevent(2) is to wait for a specified timeout to elapse. +This is implemented by the EVFILT_TIMER filter type. + +II. Problem Description + +In FreeBSD 13.1, periodic events of type EVFILT_TIMER will return at +only half of the requested frequency, following the first event. + +III. Impact + +The bug may cause misbehaviour in software that makes use of periodic +kevent(2)-based timers. + +IV. Workaround + +No workaround is available. + +V. Solution + +Upgrade your system to a supported FreeBSD stable or release / security +branch (releng) dated after the correction date and reboot. + +Perform one of the following: + +1) To update your system via a binary patch: + +Systems running a RELEASE version of FreeBSD on the amd64, i386, or +(on FreeBSD 13 and later) arm64 platforms can be updated via the +freebsd-update(8) utility: + +# freebsd-update fetch +# freebsd-update install +# shutdown -r +10min "Rebooting for an errata update" + +2) To update your system via a source code patch: + +The following patches have been verified to apply to the applicable +FreeBSD release branches. + +a) Download the relevant patch from the location below, and verify the +detached PGP signature using your PGP utility. + +# fetch https://security.FreeBSD.org/patches/EN-22:16/kqueue.patch +# fetch https://security.FreeBSD.org/patches/EN-22:16/kqueue.patch.asc +# gpg --verify kqueue.patch.asc + +b) Apply the patch. Execute the following commands as root: + +# cd /usr/src +# patch < /path/to/patch + +c) Recompile your kernel as described in +<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the +system. + +VI. Correction details + +This issue is corrected by the corresponding Git commit hash or Subversion +revision number in the following stable and release branches: + +Branch/path Hash Revision +- ------------------------------------------------------------------------- +stable/13/ 129112f80d2b stable/13-n251040 +releng/13.1/ c48048ebdbed releng/13.1-n250150 +- ------------------------------------------------------------------------- + +Run the following command to see which files were modified by a +particular commit: + +# git show --stat <commit hash> + +Or visit the following URL, replacing NNNNNN with the hash: + +<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN> + +To determine the commit count in a working tree (for comparison against +nNNNNNN in the table above), run: + +# git rev-list --count --first-parent HEAD + +VII. References + +<URL:https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=264131> + +The latest revision of this advisory is available at +<URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-22:16.kqueue.asc> +-----BEGIN PGP SIGNATURE----- + +iQIzBAEBCgAdFiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAmLyzyYACgkQ05eS9J6n +5cIBnQ//edGaUR3lij2DjA6b4sxEVMk+Kss9AL8ZOP+QYnClCT0fyKRPPtW4xGn9 +gxlbGpfhCORVgf/V+Hi9FqB1hjdBdnByPOK+p2kKdNDMivQqD75Awlxw3w/YjTTI +xBkErCIhcoo5vGh4xlTI76UYY2r02Lxl1uH5lj7AOwwTCEwkUdCSOoi4226O6mo8 +AKAErHNVtO0m3NmXW8qtfs9LwAaim6rVpyAYFK1HO0xBQIvMMkES91/iytKDkkLV +XImuOwlDnk+ql6uRrqpCaIk3313+X0k3fvaEX3hpgbDPni8qiCeFsI3wOahZjPdq +59bmrV9HKpNoalB74HsYD3SgG4v0lj8MXOPSNpAcZ9YgK77CZ6V+2WoVTNkvHVCY +x5FuBGG2VQy2k7cNZYlyjNZKvPGi+lluJXPmGt0slI9QRXZhYZrjgyRlXfC5AQy8 +P+vNt+bzGrvdrjUZ4UoV/csvvntNHB3lLH8vT/mb+UuE9VqKUWHVXadeXugRUP18 +xE+48oivScLf4FAFwjIJg5nRlvFafuzwjdiO+KWcgbnsLDfITfx0Ok6q68VDuMii +ZjzOzKKGPmBwuWJsu9WF4mL2kmyWzCJmSvpioEwHLw59Gbz7p4J7YXQDiZKgKX4e +j9AAI1M7i82y5n9PEKPa/sA7lvyZVJgqAwsDtVWnPQAhrJ+kvWE= +=dwL5 +-----END PGP SIGNATURE----- diff --git a/website/static/security/advisories/FreeBSD-EN-22:17.cam.asc b/website/static/security/advisories/FreeBSD-EN-22:17.cam.asc new file mode 100644 index 0000000000..dc5392c743 --- /dev/null +++ b/website/static/security/advisories/FreeBSD-EN-22:17.cam.asc @@ -0,0 +1,151 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +============================================================================= +FreeBSD-EN-22:17.cam Errata Notice + The FreeBSD Project + +Topic: Kernel memory corruption during SCSI error recovery + +Category: core +Module: cam +Announced: 2022-08-09 +Affects: All supported versions of FreeBSD. +Corrected: 2022-05-03 20:32:45 UTC (stable/13, 13.1-STABLE) + 2022-08-09 20:01:20 UTC (releng/13.1, 13.1-RELEASE-p1) + 2022-08-09 20:00:26 UTC (releng/13.0, 13.0-RELEASE-p12) + 2022-05-04 01:04:43 UTC (stable/12, 12.3-STABLE) + 2022-08-09 19:59:40 UTC (releng/12.3, 12.3-RELEASE-p6) + +For general information regarding FreeBSD Errata Notices and Security +Advisories, including descriptions of the fields above, security +branches, and the following sections, please visit +<URL:https://security.FreeBSD.org/>. + +I. Background + +CAM (Common Access Method) is a FreeBSD kernel subsystem which handles +various aspects of storage device management. Among other +responsibilities, it handles device error recovery and can automatically +retransmit commands to peripheral devices when a transient error is +encountered. + +II. Problem Description + +When a CAM-managed device responds to a command with an error condition, +CAM may automatically retry the command following some error recovery +protocol. For instance, it may send a SCSI START UNIT command to the +device before retrying the failed command. In this case, an in-memory +copy of the original command is preserved for a later retry. However, +a specific portion of the command state was not saved correctly, and +upon a retry this could lead to memory corruption. + +III. Impact + +The bug can cause kernel panics or other system-level misbehaviour. + +IV. Workaround + +No workaround is available. + +V. Solution + +Upgrade your system to a supported FreeBSD stable or release / security +branch (releng) dated after the correction date and reboot. + +Perform one of the following: + +1) To update your system via a binary patch: + +Systems running a RELEASE version of FreeBSD on the amd64, i386, or +(on FreeBSD 13 and later) arm64 platforms can be updated via the +freebsd-update(8) utility: + +# freebsd-update fetch +# freebsd-update install +# shutdown -r +10min "Rebooting for an errata update" + +2) To update your system via a source code patch: + +The following patches have been verified to apply to the applicable +FreeBSD release branches. + +a) Download the relevant patch from the location below, and verify the +detached PGP signature using your PGP utility. + +# fetch https://security.FreeBSD.org/patches/EN-22:17/cam.patch +# fetch https://security.FreeBSD.org/patches/EN-22:17/cam.patch.asc +# gpg --verify cam.patch.asc + +b) Apply the patch. Execute the following commands as root: + +# cd /usr/src +# patch < /path/to/patch + +c) Recompile your kernel as described in +<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the +system. + +VI. Correction details + +This issue is corrected by the corresponding Git commit hash or Subversion +revision number in the following stable and release branches: + +Branch/path Hash Revision +- ------------------------------------------------------------------------- +stable/13/ 84849cfd1dc0 stable/13-n250673 +releng/13.1/ db8082886fd8 releng/13.1-n250149 +releng/13.0/ 5430423b6d63 releng/13.0-n244803 +stable/12/ r372069 +releng/12.3/ r372378 +- ------------------------------------------------------------------------- + +For FreeBSD 13 and later: + +Run the following command to see which files were modified by a +particular commit: + +# git show --stat <commit hash> + +Or visit the following URL, replacing NNNNNN with the hash: + +<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN> + +To determine the commit count in a working tree (for comparison against +nNNNNNN in the table above), run: + +# git rev-list --count --first-parent HEAD + +For FreeBSD 12 and earlier: + +Run the following command to see which files were modified by a particular +revision, replacing NNNNNN with the revision number: + +# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base + +Or visit the following URL, replacing NNNNNN with the revision number: + +<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN> + +VII. References + +<URL:https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=262894> + +The latest revision of this advisory is available at +<URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-22:17.cam.asc> +-----BEGIN PGP SIGNATURE----- + +iQIzBAEBCgAdFiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAmLyz0YACgkQ05eS9J6n +5cIECxAAo+zofqG4H2ZTffIBo3YElCbB8pkXty/ZnW0+3cA+JWcYtpC+5UoKw68q +wBN+fL8174tzkzsrN3ZZcmtd28NtlmNYpUbCQCji90K8CSSRibsa+IdGxRDkiTAL +s/bHpn4Txyi+XiIDFVABWDuUf3rNxVqgmnWorMTnffukUkXxDYGbwTD4J9eaahhH +eEG/iW/O8KL34Asb4Pg/KoY8TAp8U3ojd+/XrLkLHHm1VyAqiW7cYVLcKFFDArT0 +NUdqI/B329Jk4qy/FDqbturLGQyxpkeAnB1ARLaQ/DvNQNxoLLv2MbS2/92JiR/y +pWrIz0brUp/zrtH5qEQxrvutHKch2CfQnansBs4d/atCyYQsrfTt+1QTpcbqdFJv +L0ysPjuHYuFnizjospjaRJfNYQMUK64q5BBJeymNTMpXjYz2SG1K6BlsU001i51o +tCXTfFJ35GjIJqiXL8K7aCiu0L8HFJ8zHIGBJv8gB8q/kNlDCCluks5nBGwktboM +91WhbskyR/5en5drBB1RxXYsYDYcJiwDENLmTHyJK/9v55tRlsu6yMUb3sxwV5+G +YC4z/GYEBfj5u/ttb0ILZX2eBHx/kIae0wW9x2ch6njOiSp1tcujEH74OIw1a4ja +fOfWZsBjB23rIawn3eDLVnLtE9l1ljIsvy2rbVf4xNxxl3x68ZM= +=Ujr3 +-----END PGP SIGNATURE----- diff --git a/website/static/security/advisories/FreeBSD-EN-22:18.wifi.asc b/website/static/security/advisories/FreeBSD-EN-22:18.wifi.asc new file mode 100644 index 0000000000..16c955af6b --- /dev/null +++ b/website/static/security/advisories/FreeBSD-EN-22:18.wifi.asc @@ -0,0 +1,130 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +============================================================================= +FreeBSD-EN-22:18.wifi Errata Notice + The FreeBSD Project + +Topic: WiFi patch update + +Category: core +Module: net80211 +Announced: 2022-08-09 +Affects: FreeBSD 13.0 +Corrected: 2022-08-09 20:11:00 UTC (releng/13.0, 13.0-RELEASE-p12) + +Note: The corrected date and patch revision above (p12) are specific to the + 13.0-RELEASE version published via freebsd-update. The revision details + in the table below reference the git repository information, which was + correct at the time of the original WiFi patch. + +For general information regarding FreeBSD Errata Notices and Security +Advisories, including descriptions of the fields above, security +branches, and the following sections, please visit +<URL:https://security.FreeBSD.org/>. + +I. Background + +FreeBSD's net80211 kernel subsystem provides infrastructure and drivers +for IEEE 802.11 wireless (Wi-Fi) communications. + +II. Problem Description + +FreeBSD-SA-22:02.wifi included a number of improvements to net80211 data +validation. Some of these changes were not included in the patch provided +for FreeBSD 13.0 and via freebsd-update. The changes were included in the +git repository. + +III. Impact + +The interface affected by the missing change is only available to the +superuser. The superuser may be able to cause kernel crash. + +IV. Workaround + +No workaround is available. + +V. Solution + +Upgrade your system to a supported FreeBSD stable or release / security +branch (releng) dated after the correction date, and reboot. + +Perform one of the following: + +1) To update your system via a binary patch: + +Systems running a RELEASE version of FreeBSD on the amd64, i386, or +(on FreeBSD 13 and later) arm64 platforms can be updated via the +freebsd-update(8) utility: + +# freebsd-update fetch +# freebsd-update install +# shutdown -r +5min "Installing errata update" + +2) To update your system via a source code patch: + +The following patches have been verified to apply to the applicable +FreeBSD release branches. + +a) Download the relevant patch from the location below, and verify the +detached PGP signature using your PGP utility. + +# fetch https://security.FreeBSD.org/patches/EN-22:18/wifi.patch +# fetch https://security.FreeBSD.org/patches/EN-22:18/wifi.patch.asc +# gpg --verify wifi.patch.asc + +b) Apply the patch. Execute the following commands as root: + +# cd /usr/src +# patch < /path/to/patch + +c) Recompile your kernel as described in +<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the +system. + +VI. Correction details + +This issue is corrected by the corresponding Git commit hash or Subversion +revision number in the following stable and release branches: + +Branch/path Hash Revision +- ------------------------------------------------------------------------- +releng/13.0/ 0d1db5c3257e releng/13.0-n244782 +- ------------------------------------------------------------------------- + +Run the following command to see which files were modified by a +particular commit: + +# git show --stat <commit hash> + +Or visit the following URL, replacing NNNNNN with the hash: + +<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN> + +To determine the commit count in a working tree (for comparison against +nNNNNNN in the table above), run: + +# git rev-list --count --first-parent HEAD + +VII. References + +<URL:https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=254737> + +The latest revision of this advisory is available at +<URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-22:18.wifi.asc> +-----BEGIN PGP SIGNATURE----- + +iQIzBAEBCgAdFiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAmLyz0YACgkQ05eS9J6n +5cIYBA//VQCS16TK3QcOXDznzTi66YqL5GvCklVWzk52la+D0cIazzNKKWLwuJAF +bAB9c+jjff0IU6J80/QNdTEvXBjw4HZ5CsniXEUbWMmQOdFh1c9mgW8q6W8PV+R9 +DYn7ROO/d8s71Kh8FQh9KzguCYsiSHm8gwfwSzi1bxfBp6J2Af2A/q/4KO7/mN/U +Eltgr3AikjqvLm5vo985Fbv2ExH9Xm3rZcc3UggutyNFAtl4X4N/1Pux5msR38sp +FIzveVKtu2kuQ9jqOceABZfaxCCXRwl5i/MibOdfZb3+JIdjDSnuH6fjVmVT3Qys +4LFnokEFNtSn04z6VJHmtryqIuByVWWSyyFFpm65pKtpvxzEP+Wrql208U7k+r7A +gi1vZVcJpZ5eLEdPgmE7T4IjfuonK0DvVkJlWIigmrFn2n4ss1cyQiNJYyujDDQB +sCcC3HZoy8DE4RBzpfEWDjsoqQXzJ81o3TfnNr69alSVAmMRzcQjH8z6syApuq+0 +RmyHMCfgKnbPCtgQj0si8VRDtMfgqJsTqHsTks6NiL6csQUTtgYc37MgErLsUR05 +4XnfxvslAketx9BvWqgF6eIXnGoJsCopzVKOttxdqpyV1AzanZzl0q+wEBp8WND0 +Jpzhtmar9Pxq9wcRNNx8as5b5IyH1zp4/0FqztGsLgHluazYPbk= +=W4Fk +-----END PGP SIGNATURE----- diff --git a/website/static/security/advisories/FreeBSD-EN-22:19.pam_exec.asc b/website/static/security/advisories/FreeBSD-EN-22:19.pam_exec.asc new file mode 100644 index 0000000000..e181940094 --- /dev/null +++ b/website/static/security/advisories/FreeBSD-EN-22:19.pam_exec.asc @@ -0,0 +1,132 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +============================================================================= +FreeBSD-EN-22:19.pam_exec Errata Notice + The FreeBSD Project + +Topic: NULL pointer dereference in pam_exec(8) + +Category: core +Module: pam +Announced: 2022-08-09 +Affects: FreeBSD 13.0 and later +Corrected: 2022-06-24 09:09:59 UTC (stable/13, 13.1-STABLE) + 2022-08-09 20:01:22 UTC (releng/13.1, 13.1-RELEASE-p1) + 2022-08-09 20:00:25 UTC (releng/13.0, 13.0-RELEASE-p12) + +For general information regarding FreeBSD Errata Notices and Security +Advisories, including descriptions of the fields above, security +branches, and the following sections, please visit +<URL:https://security.FreeBSD.org/>. + +I. Background + +pam_exec(8) is a pam(3) module for delegating PAM service functions to an +external program. When used for authentication, it can pass the user's +authentication token to the external program. + +II. Problem Description + +When pam_exec(8) is used for authentication with the `expose_authtok' option +and an application calls pam_setcred(3), it attempts to expose an already +stored authentication token. It is incorrectly assumed that there always is +such a token stored, which leads to dereferencing a NULL pointer if this +isn't the case. + +III. Impact + +It is impossible to reliably use pam_exec(8) for authentication with the +`expose_authtok' option, that is necessary to have the external program check +credentials. In most scenarios, authentication will fail because of a crash +caused by the NULL pointer dereference. + +IV. Workaround + +No workaround is available, however systems not using pam_exec(8) for +authentication are not affected. + +V. Solution + +Upgrade your system to a supported FreeBSD stable or release / security +branch (releng) dated after the correction date. + +Perform one of the following: + +1) To update your system via a binary patch: + +Systems running a RELEASE version of FreeBSD on the amd64, i386, or +(on FreeBSD 13 and later) arm64 platforms can be updated via the +freebsd-update(8) utility: + +# freebsd-update fetch +# freebsd-update install + +2) To update your system via a source code patch: + +The following patches have been verified to apply to the applicable +FreeBSD release branches. + +a) Download the relevant patch from the location below, and verify the +detached PGP signature using your PGP utility. + +# fetch https://security.FreeBSD.org/patches/EN-22:19/pam_exec.patch +# fetch https://security.FreeBSD.org/patches/EN-22:19/pam_exec.patch.asc +# gpg --verify pam_exec.patch.asc + +b) Apply the patch. Execute the following commands as root: + +# cd /usr/src +# patch < /path/to/patch + +c) Recompile the operating system using buildworld and installworld as +described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>. + +VI. Correction details + +This issue is corrected by the corresponding Git commit hash or Subversion +revision number in the following stable and release branches: + +Branch/path Hash Revision +- ------------------------------------------------------------------------- +stable/13/ ea80848e1c06 stable/13-n251487 +releng/13.1/ 26db194f3db1 releng/13.1-n250151 +releng/13.0/ 277c0c4d2512 releng/13.0-n244802 +- ------------------------------------------------------------------------- + +Run the following command to see which files were modified by a +particular commit: + +# git show --stat <commit hash> + +Or visit the following URL, replacing NNNNNN with the hash: + +<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN> + +To determine the commit count in a working tree (for comparison against +nNNNNNN in the table above), run: + +# git rev-list --count --first-parent HEAD + +VII. References + +<URL:https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=263893> + +The latest revision of this advisory is available at +<URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-22:19.pam_exec.asc> +-----BEGIN PGP SIGNATURE----- + +iQIzBAEBCgAdFiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAmLyz0cACgkQ05eS9J6n +5cJs9Q//WY8wGjWIUpmQ2Z/R9aHp7+MsFXiJ+bmwiYeX7bAWDC5uienqML62ir7y +Lqnx6B0Njkn8VmV+6/R6ACCXyNbg+zSXbecOFAkclB3x65CZbOAmgvtUYKCuSdGl +EzGTBOoVPIr3aowpMsnc7MULF5WXxsDfb+mqT1MIo5gmsxIIulHwui0AnPzOhmH2 +gUeuA5CIsZk+QgJetAg28K0fB4pbKquX82sSiDbfMK+MrXOVugSTHDq1w+01LbW/ +YKNSo+kkMw+NmDBD46ibrMDJCVucdwpGISDzhJNALnUudLb8f7cbF/NN1Cd14zxA +P8qY7CHmkSUVtREDGcvJ4TYIXtvCuT5iUaWymDkN1URu6MM0Ixa6JkG8yYBMi802 +Vg7/I2Z0I6F0oeDISmFGvF1Kic50sWL7pnPTpoNudI8RhRJzvNQpE67oF1IIdsEy +Ij8aCRbkhirtlETUFmJw7YOWRVnMs9peahimmHVZ0bVwBG5eWuLb/7mSXtSvnUeD +Af7U0Z82GHtb0vyFvc1zJcQa+nvkQGzEPsBTC8PxYdba1ZK5zJ9JW3cuSmJYW6jW +Jao/8DvRQa0PrQe4ahy2xqa/ImYTr9RMaIT+x8ArRm4glfMZNDtbLjfgh0ebRGn+ +Fhh1DS7URCijOwsK9pM1mX7zaROINyyXpGNhnzd2SJsH9p31VaE= +=JZ5O +-----END PGP SIGNATURE----- diff --git a/website/static/security/advisories/FreeBSD-SA-22:09.elf.asc b/website/static/security/advisories/FreeBSD-SA-22:09.elf.asc new file mode 100644 index 0000000000..f13cd3662b --- /dev/null +++ b/website/static/security/advisories/FreeBSD-SA-22:09.elf.asc @@ -0,0 +1,156 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +============================================================================= +FreeBSD-SA-22:09.elf Security Advisory + The FreeBSD Project + +Topic: Out of bound read in elf_note_prpsinfo() + +Category: core +Module: kernel +Announced: 2022-08-09 +Credits: Josef 'Jeff' Sipek +Affects: All supported versions of FreeBSD. +Corrected: 2022-08-09 19:47:32 UTC (stable/13, 13.1-STABLE) + 2022-08-09 20:00:43 UTC (releng/13.1, 13.1-RELEASE-p1) + 2022-08-09 19:59:14 UTC (releng/13.0, 13.0-RELEASE-p12) + 2022-08-09 19:57:35 UTC (stable/12, 12.3-STABLE) + 2022-08-09 19:59:47 UTC (releng/12.3, 12.3-RELEASE-p6) +CVE Name: CVE-2022-23089 + +For general information regarding FreeBSD Security Advisories, +including descriptions of the fields above, security branches, and the +following sections, please visit <URL:https://security.FreeBSD.org/>. + +I. Background + +Process information known as "prpsinfo" is written when dumping core of a +process as an ELF note. + +The sbuf family of functions allows one to safely allocate, compose and +release strings in kernel or user space. + +II. Problem Description + +When dumping core and saving process information, proc_getargv() might +return an sbuf which have a sbuf_len() of 0 or -1, which is not properly +handled. + +III. Impact + +An out-of-bound read can happen when user constructs a specially crafted +ps_string, which in turn can cause the kernel to crash. + +IV. Workaround + +The system administrator can workaround this issue by disabling coredump. +This can be done by adding: + +kern.coredump=0 + +to /etc/sysctl.conf and run `service sysctl start`. + +V. Solution + +Upgrade your vulnerable system to a supported FreeBSD stable or +release / security branch (releng) dated after the correction date. + +A reboot is required after applying the fix. + +Perform one of the following: + +1) To update your vulnerable system via a binary patch: + +Systems running a RELEASE version of FreeBSD on the amd64, i386, or +(on FreeBSD 13 and later) arm64 platforms can be updated via the +freebsd-update(8) utility: + +# freebsd-update fetch +# freebsd-update install +# shutdown -r +10min "Rebooting for a security update" + +2) To update your vulnerable system via a source code patch: + +The following patches have been verified to apply to the applicable +FreeBSD release branches. + +a) Download the relevant patch from the location below, and verify the +detached PGP signature using your PGP utility. + +# fetch https://security.FreeBSD.org/patches/SA-22:09/elf.patch +# fetch https://security.FreeBSD.org/patches/SA-22:09/elf.patch.asc +# gpg --verify elf.patch.asc + +b) Apply the patch. Execute the following commands as root: + +# cd /usr/src +# patch < /path/to/patch + +c) Recompile your kernel as described in +<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the +system. + +VI. Correction details + +This issue is corrected by the corresponding Git commit hash or Subversion +revision number in the following stable and release branches: + +Branch/path Hash Revision +- ------------------------------------------------------------------------- +stable/13/ 8a44a2c644fc stable/13-n252079 +releng/13.1/ 69a456c0b60b releng/13.1-n250152 +releng/13.0/ 056ffc74a769 releng/13.0-n244804 +stable/12/ r372376 +releng/12.3/ r372380 +- ------------------------------------------------------------------------- + +For FreeBSD 13 and later: + +Run the following command to see which files were modified by a +particular commit: + +# git show --stat <commit hash> + +Or visit the following URL, replacing NNNNNN with the hash: + +<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN> + +To determine the commit count in a working tree (for comparison against +nNNNNNN in the table above), run: + +# git rev-list --count --first-parent HEAD + +For FreeBSD 12 and earlier: + +Run the following command to see which files were modified by a particular +revision, replacing NNNNNN with the revision number: + +# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base + +Or visit the following URL, replacing NNNNNN with the revision number: + +<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN> + +VII. References + +<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23089> + +The latest revision of this advisory is available at +<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-22:09.elf.asc> +-----BEGIN PGP SIGNATURE----- + +iQIzBAEBCgAdFiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAmLyz1EACgkQ05eS9J6n +5cJ6tw//VycxB1Il6TKajIo9VQE5lN1M/h1j0fbyUokXWpcGH/+iGl4sLkxtrFuv +Ekjshp9AezGgSIWCEdcwx8ck3LUeU0kVhAjcJjI/p+YfSWcWlLTQk13/Z3FsF6pv +EK1VjKDiMpZHbddbkvY2q4JKIdO2UXgBYwtshvwHL+Y8Ev2cxvJdQfwtclf+N0Q6 +Shgf25XPqkrG9vCJ30ldlJs902PoHKyGUOqU0+4741rcaZBjeF26RQPOXT+z4yQz +RpVQvyQ01OnXgXO8X+7hoW83m3C7hNz5KnmX5YLMQCBUgYjBk4edeOlnq1wnRTtW +k0qPdkIa5Rj8Yq8k+VP3PMiKezXOmxrmXUV16j64KZM9+r0eNPYx0C8sgkLZSrRe +osk57jIYtI0M7fTVNlhMY7uCLFaK3xHb+/Md+ExpCs79ZbH+CxgnU+HPyIIVV4zX +RhDRAh/w/MVKcHJM7y2TM6VDDhiLNqWeV9ruMj92ZnkB+QnRqrah53JUlo8PQcFn +oDfe/pSGhchpjwyhwHoXTBQNQjUlbm/7iC95D0UdtfuH2eFcSdDq6aWMO5amxui0 +Kkm+nswlYIpJsq3Addu2pEEhh2DHIwF9wiz8DKFJ1et+BF+GW+V4XKvXSd8sO7j3 +19GK3xtf9cGnYYoPBpNSxuFLP+zcb+1gXTX+N9gG1EqQfXdjMtI= +=lK0G +-----END PGP SIGNATURE----- diff --git a/website/static/security/advisories/FreeBSD-SA-22:10.aio.asc b/website/static/security/advisories/FreeBSD-SA-22:10.aio.asc new file mode 100644 index 0000000000..c7cc4430e0 --- /dev/null +++ b/website/static/security/advisories/FreeBSD-SA-22:10.aio.asc @@ -0,0 +1,151 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +============================================================================= +FreeBSD-SA-22:10.aio Security Advisory + The FreeBSD Project + +Topic: AIO credential reference count leak + +Category: core +Module: kernel +Announced: 2022-08-09 +Credits: Chris J-D <[email protected]> +Affects: FreeBSD 12.3, FreeBSD 13.0 +Corrected: 2021-10-01 00:32:22 UTC (stable/13, 13.0-STABLE) + 2022-08-09 20:00:24 UTC (releng/13.0, 13.0-RELEASE-p12) + 2022-06-27 17:27:50 UTC (stable/12, 12.3-STABLE) + 2022-08-09 19:59:44 UTC (releng/12.3, 12.3-RELEASE-p6) +CVE Name: CVE-2022-23090 + +For general information regarding FreeBSD Security Advisories, +including descriptions of the fields above, security branches, and the +following sections, please visit <URL:https://security.FreeBSD.org/>. + +I. Background + +FreeBSD's aio(4) subsystem implements asynchronous I/O. + +II. Problem Description + +The aio_aqueue function, used by the lio_listio system call, fails to release +a reference to a credential in an error case. + +III. Impact + +An attacker may cause the reference count to overflow, leading to a +use after free (UAF). + +IV. Workaround + +No workaround is available. + +V. Solution + +Upgrade your vulnerable system to a supported FreeBSD stable or +release / security branch (releng) dated after the correction date, +and reboot. + +Perform one of the following: + +1) To update your vulnerable system via a binary patch: + +Systems running a RELEASE version of FreeBSD on the amd64, i386, or +(on FreeBSD 13 and later) arm64 platforms can be updated via the +freebsd-update(8) utility: + +# freebsd-update fetch +# freebsd-update install +# shutdown -r +10min "Rebooting for a security update" + +2) To update your vulnerable system via a source code patch: + +The following patches have been verified to apply to the applicable +FreeBSD release branches. + +a) Download the relevant patch from the location below, and verify the +detached PGP signature using your PGP utility. + +[FreeBSD 12.3] +# fetch https://security.FreeBSD.org/patches/SA-22:10/aio.12.patch +# fetch https://security.FreeBSD.org/patches/SA-22:10/aio.12.patch.asc +# gpg --verify aio.12.patch.asc + +[FreeBSD 13.0] +# fetch https://security.FreeBSD.org/patches/SA-22:10/aio.13.patch +# fetch https://security.FreeBSD.org/patches/SA-22:10/aio.13.patch.asc +# gpg --verify aio.13.patch.asc + +b) Apply the patch. Execute the following commands as root: + +# cd /usr/src +# patch < /path/to/patch + +c) Recompile your kernel as described in +<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the +system. + +VI. Correction details + +This issue is corrected by the corresponding Git commit hash or Subversion +revision number in the following stable and release branches: + +Branch/path Hash Revision +- ------------------------------------------------------------------------- +stable/13/ 9499d3c1e40d stable/13-n247480 +releng/13.0/ c864c8cf08a9 releng/13.0-n244801 +stable/12/ r372172 +releng/12.3/ r372379 +- ------------------------------------------------------------------------- + +For FreeBSD 13 and later: + +Run the following command to see which files were modified by a +particular commit: + +# git show --stat <commit hash> + +Or visit the following URL, replacing NNNNNN with the hash: + +<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN> + +To determine the commit count in a working tree (for comparison against +nNNNNNN in the table above), run: + +# git rev-list --count --first-parent HEAD + +For FreeBSD 12 and earlier: + +Run the following command to see which files were modified by a particular +revision, replacing NNNNNN with the revision number: + +# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base + +Or visit the following URL, replacing NNNNNN with the revision number: + +<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN> + +VII. References + +<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23090> + +<URL:https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=258698> + +The latest revision of this advisory is available at +<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-22:10.aio.asc> +-----BEGIN PGP SIGNATURE----- + +iQIzBAEBCgAdFiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAmLyz1EACgkQ05eS9J6n +5cI0ZBAAi90yUPtPxBcshN+DldO6WSuQEWBE5XU+7Ivesns80PMF+QuQ9S/YfurC +I0LNfjGe48Q4/CIfixLf3Xsari9IBmHpUPvJS3+TaoxrOLRTLv2uTCZl6mGj1iqL +H4ufrtMCbaA830EAKlEfCfI6eY8eDJpKh+he86adW3qNPWewTKGeEK8Mi4st009F +DcCcHquy+IC2DnZaeoO+dttKyMoyEJgvo8F0oej8Jg7OBPdW6yTuabutQkuxSur/ +JChz+Gn0tKj9qtN6023T/JvDXBKsQVlURbGofHhcm5JkpFFVd0A4+2MLbAO24gJa +fnYRJDaWbRHvF0joy3qbZWZ/a3iHHC+yq7jupHoOkP7yULUQRftoj2kdPPZic6eQ +XcyZE3rKgk7CHJq1ofg/Ye6WTgEghWjUlp5yrTniL+uWp6YuSVZNKPvXweDpi45M +segQvlLoDWG3GEhaRyvaeBkA4v1lLucdkLQCM9bAFPhq5S27lcHPf9r4jiWBR5HB +yQKddJZGa5lzsiYhKfX+pJ4rQa3QPN7N1NRygXDp4WRcPCqV3r4owZNJs6rsPkVM +c0+wyGZhv4jH8lRrludMeXkiusoYOHEE+hslA+xU3M+19ak7W3DkJZKvEZQgBMNs +bobKi/rl0GmAJthxd+vLXmdRK8g50RhPP+Fq80eLct151DDBdd0= +=7sbf +-----END PGP SIGNATURE----- diff --git a/website/static/security/advisories/FreeBSD-SA-22:11.vm.asc b/website/static/security/advisories/FreeBSD-SA-22:11.vm.asc new file mode 100644 index 0000000000..d88f109c97 --- /dev/null +++ b/website/static/security/advisories/FreeBSD-SA-22:11.vm.asc @@ -0,0 +1,149 @@ *** 708 LINES SKIPPED ***