Commit Graph

6629 Commits

Author SHA1 Message Date
Joachim F
8604630d92 Merge pull request #26939 from dtzWill/fix/perms-fallout-misc-2
Fixup various setuid/setgid permission problems, part 2
2017-06-30 18:30:02 +01:00
Jörg Thalheim
79ecfb515f Merge pull request #26972 from zx2c4/patch-5
wireguard: 0.0.20170613 -> 0.0.20170629
2017-06-30 08:40:40 +01:00
Tim Steinbach
3130f3ed0a
linux-copperhead: 4.11.7.a -> 4.11.8.a
Fixes #26790 by properly including built modules
2017-06-29 23:16:52 -04:00
Jason A. Donenfeld
9ffccc77d9 wireguard: 0.0.20170613 -> 0.0.20170629
Simple version bump.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-06-29 22:27:52 +02:00
Tim Steinbach
37bc494949
linux: 4.11.7 -> 4.11.8 2017-06-29 08:29:04 -04:00
Tim Steinbach
d1aff8d2e5
linux: 4.9.34 -> 4.9.35
Also, remove XSA-216 patches, the fixes are now integrated upstream
2017-06-29 08:26:25 -04:00
Tim Steinbach
6b35f22e28
linux: 4.4.74 -> 4.4.75 2017-06-29 08:20:06 -04:00
Tim Steinbach
4cc729644e Merge pull request #26867 from michalpalka/xen-security-2017.06-new
xen: patch for XSAs: 216, 217, 218, 219, 220, 221, 222, and 224
2017-06-28 22:43:46 -04:00
John Ericson
eb052edd6f Merge pull request #26946 from obsidiansystems/wxmsw-fix
wxMSW: Fix syntax --- travis eval did not catch
2017-06-28 22:39:36 -04:00
John Ericson
b0ada07f36 wxMSW: Fix syntax --- travis eval did not catch 2017-06-28 22:31:24 -04:00
John Ericson
e1faeb574a Merge pull request #26884 from obsidiansystems/purge-stdenv-cross
Purge stdenv cross
2017-06-28 21:39:16 -04:00
hsloan
2f37cad1b9 wxMSW-2.8: Don't use stdenv ? cross 2017-06-28 21:29:07 -04:00
hsloan
c4ab3ef580 jom: Don't use stdenc.cross 2017-06-28 21:29:07 -04:00
hsloan
14d3ed8c38 sysvinit: Rely on cc-wrapper to export this env var 2017-06-28 21:29:07 -04:00
hsloan
a291194d2f shadow: Don't use stdenv ? cross 2017-06-28 21:28:34 -04:00
hsloan
b8ed3c65bb propcps: Rely on cc-wrapper to export this env var 2017-06-28 21:24:25 -04:00
hsloan
66e22e1229 mingetty: Rely on cc-wrapper to export this env var 2017-06-28 21:24:24 -04:00
hsloan
5d83d36389 mdadm: Don't use stdenv.cross 2017-06-28 21:24:24 -04:00
hsloan
a210b08d18 klibc: Don't use crossAttrs 2017-06-28 21:24:12 -04:00
hsloan
16781a3892 kernel perf: Don't use stdenv.cross 2017-06-28 20:23:09 -04:00
hsloan
1e3b45cfdb kernel manual-config: Don't use stdenv.cross 2017-06-28 20:23:09 -04:00
hsloan
459d07d41c kernel generic: Don't use stdenv.cross 2017-06-28 20:22:59 -04:00
hsloan
c5b4b6c911 kernel-headers: Don't use stdenv.cross 2017-06-28 19:44:04 -04:00
Will Dietz
707145a955 firejail: don't try to set setuid bit 2017-06-28 14:31:47 -05:00
Will Dietz
09d85c49c4 kbdlight: Fix installation permissions
Looks like NixOS creates a security wrapper for this already, FWIW.
2017-06-28 14:31:45 -05:00
Eelco Dolstra
32e492251b
systemd: Apply fix for CVE-2017-9445 2017-06-28 14:08:05 +02:00
Trevor Joynson
068341b1c7 iptstate: init at 2.2.6 (#26878)
* Add iptstate package

* iptstate: nit pick
2017-06-27 18:27:13 +01:00
Tim Steinbach
d2e199ca3c
linux: 4.4.73 -> 4.4.74 2017-06-27 08:14:47 -04:00
Tim Steinbach
c90a4b8541
linux: 4.12-rc6 -> 4.12-rc7 2017-06-26 09:58:37 -04:00
Franz Pletz
b788956239
libcgroup: do not set suid bit in nix store 2017-06-26 09:13:34 +02:00
Michał Pałka
80e0cda7ff xen: patch for XSAs: 216, 217, 218, 219, 220, 221, 222, and 224
XSA-216 Issue Description:

> The block interface response structure has some discontiguous fields.
> Certain backends populate the structure fields of an otherwise
> uninitialized instance of this structure on their stacks, leaking
> data through the (internal or trailing) padding field.

More: https://xenbits.xen.org/xsa/advisory-216.html

XSA-217 Issue Description:

> Domains controlling other domains are permitted to map pages owned by
> the domain being controlled.  If the controlling domain unmaps such a
> page without flushing the TLB, and if soon after the domain being
> controlled transfers this page to another PV domain (via
> GNTTABOP_transfer or, indirectly, XENMEM_exchange), and that third
> domain uses the page as a page table, the controlling domain will have
> write access to a live page table until the applicable TLB entry is
> flushed or evicted.  Note that the domain being controlled is
> necessarily HVM, while the controlling domain is PV.

More: https://xenbits.xen.org/xsa/advisory-217.html

XSA-218 Issue Description:

> We have discovered two bugs in the code unmapping grant references.
>
> * When a grant had been mapped twice by a backend domain, and then
> unmapped by two concurrent unmap calls, the frontend may be informed
> that the page had no further mappings when the first call completed rather
> than when the second call completed.
>
> * A race triggerable by an unprivileged guest could cause a grant
> maptrack entry for grants to be "freed" twice.  The ultimate effect of
> this would be for maptrack entries for a single domain to be re-used.

More: https://xenbits.xen.org/xsa/advisory-218.html

XSA-219 Issue Description:

> When using shadow paging, writes to guest pagetables must be trapped and
> emulated, so the shadows can be suitably adjusted as well.
>
> When emulating the write, Xen maps the guests pagetable(s) to make the final
> adjustment and leave the guest's view of its state consistent.
>
> However, when mapping the frame, Xen drops the page reference before
> performing the write.  This is a race window where the underlying frame can
> change ownership.
>
> One possible attack scenario is for the frame to change ownership and to be
> inserted into a PV guest's pagetables.  At that point, the emulated write will
> be an unaudited modification to the PV pagetables whose value is under guest
> control.

More: https://xenbits.xen.org/xsa/advisory-219.html

XSA-220 Issue Description:

> Memory Protection Extensions (MPX) and Protection Key (PKU) are features in
> newer processors, whose state is intended to be per-thread and context
> switched along with all other XSAVE state.
>
> Xen's vCPU context switch code would save and restore the state only
> if the guest had set the relevant XSTATE enable bits.  However,
> surprisingly, the use of these features is not dependent (PKU) or may
> not be dependent (MPX) on having the relevant XSTATE bits enabled.
>
> VMs which use MPX or PKU, and context switch the state manually rather
> than via XSAVE, will have the state leak between vCPUs (possibly,
> between vCPUs in different guests).  This in turn corrupts state in
> the destination vCPU, and hence may lead to weakened protections
>
> Experimentally, MPX appears not to make any interaction with BND*
> state if BNDCFGS.EN is set but XCR0.BND{CSR,REGS} are clear.  However,
> the SDM is not clear in this case; therefore MPX is included in this
> advisory as a precaution.

More: https://xenbits.xen.org/xsa/advisory-220.html

XSA-221 Issue Description:

> When polling event channels, in general arbitrary port numbers can be
> specified.  Specifically, there is no requirement that a polled event
> channel ports has ever been created.  When the code was generalised
> from an earlier implementation, introducing some intermediate
> pointers, a check should have been made that these intermediate
> pointers are non-NULL.  However, that check was omitted.

More: https://xenbits.xen.org/xsa/advisory-221.html

XSA-222 Issue Description:

> Certain actions require removing pages from a guest's P2M
> (Physical-to-Machine) mapping.  When large pages are in use to map
> guest pages in the 2nd-stage page tables, such a removal operation may
> incur a memory allocation (to replace a large mapping with individual
> smaller ones).  If this allocation fails, these errors are ignored by
> the callers, which would then continue and (for example) free the
> referenced page for reuse.  This leaves the guest with a mapping to a
> page it shouldn't have access to.
>
> The allocation involved comes from a separate pool of memory created
> when the domain is created; under normal operating conditions it never
> fails, but a malicious guest may be able to engineer situations where
> this pool is exhausted.

More: https://xenbits.xen.org/xsa/advisory-222.html

XSA-224 Issue Description:

> We have discovered a number of bugs in the code mapping and unmapping
> grant references.
>
> * If a grant is mapped with both the GNTMAP_device_map and
> GNTMAP_host_map flags, but unmapped only with host_map, the device_map
> portion remains but the page reference counts are lowered as though it
> had been removed. This bug can be leveraged cause a page's reference
> counts and type counts to fall to zero while retaining writeable
> mappings to the page.
>
> * Under some specific conditions, if a grant is mapped with both the
> GNTMAP_device_map and GNTMAP_host_map flags, the operation may not
> grab sufficient type counts.  When the grant is then unmapped, the
> type count will be erroneously reduced.  This bug can be leveraged
> cause a page's reference counts and type counts to fall to zero while
> retaining writeable mappings to the page.
>
> * When a grant reference is given to an MMIO region (as opposed to a
> normal guest page), if the grant is mapped with only the
> GNTMAP_device_map flag set, a mapping is created at host_addr anyway.
> This does *not* cause reference counts to change, but there will be no
> record of this mapping, so it will not be considered when reporting
> whether the grant is still in use.

More: https://xenbits.xen.org/xsa/advisory-224.html
2017-06-26 07:01:24 +00:00
Gabriel Ebner
252e9ec84a microcodeIntel: 20161104 -> 20170511 2017-06-25 17:41:57 +02:00
Tim Steinbach
03aed4cfcf
linux-copperhead: 4.11.6.d -> 4.11.7.a 2017-06-24 14:50:41 -04:00
Jörg Thalheim
d4f45ae393 Merge pull request #26734 from nh2/statifier-1.7.4
statifier: 1.7.3 -> 1.7.4
2017-06-24 18:16:25 +01:00
Tim Steinbach
b06cb59fc1
linux: 4.9.33 -> 4.9.34 2017-06-24 11:22:56 -04:00
Tim Steinbach
3a68f0bb78
linux: 4.11.6 -> 4.11.7 2017-06-24 11:20:32 -04:00
Jörg Thalheim
5e2de6d846 iwd: 2017-04-21 -> 2017-06-02 2017-06-24 10:29:14 +01:00
Jörg Thalheim
a087e5a53a lttng-modules: 2.9.1 -> 2.9.3 2017-06-24 10:26:19 +01:00
John Ericson
a24031317a Merge pull request #26798 from obsidiansystems/ios-cross-stdenv
ios-cross: Just properly use the cc-wrapper
2017-06-23 15:00:19 -04:00
John Ericson
afd2bdbad2 Merge pull request #26007 from obsidiansystems/cc-wrapper-prefix
Get rid of gcc-cross-wrapper
2017-06-23 11:22:34 -04:00
Tim Steinbach
4e08459f9b
linux-hardened-copperhead: 4.11.6c -> 4.11.6d 2017-06-22 21:12:20 -04:00
John Ericson
f43ae985a6 ios-cross: Just properly use the cc-wrapper
No other downstream derivations are needed anymore.
2017-06-22 17:56:12 -04:00
John Ericson
05b3c87d9d busybox: Modernize and fix cross 2017-06-22 17:53:53 -04:00
John Ericson
fc42ec0a5c mingw-w64: Depend on own headers derivation
Without this, a `#include <float.h>` resolves incorrectly. Either the
headers weren't on the include path at all, or they only were for
local, not system, imports.

What's weird is this used to not be a problem. Not sure what other
change in e.g. cc-wrapper would affect this.
2017-06-22 17:53:51 -04:00
John Ericson
bb7067f882 mingw-w64: Clean up, especially clarifying staging 2017-06-22 17:53:51 -04:00
Franz Pletz
dd3f2e648a
linux_hardened_copperhead: init at 4.11.6.c 2017-06-21 23:49:00 +02:00
Jörg Thalheim
e89e96a755 linux_4_11: renable CONFIG_UPROBE_EVENTS
CONFIG_UPROBE_EVENT was renamed to CONFIG_UPROBE_EVENTS.
2017-06-21 17:16:46 +01:00
Niklas Hambüchen
2fe0cd548c statifier: 1.7.3 -> 1.7.4 2017-06-21 01:12:38 +02:00
Franz Pletz
f4734e75db
libnl: 3.2.29 -> 3.3.0 2017-06-20 07:03:53 +02:00
Franz Pletz
baf28b60e4
libcap_ng: 0.7.7 -> 0.7.8 2017-06-20 05:57:03 +02:00