From 51dcceb99b46dab5728b86373ac6a3ce61d76313 Mon Sep 17 00:00:00 2001 From: des Date: Tue, 4 Nov 2014 23:31:17 +0000 Subject: [PATCH] [SA-14:24] Fix denial of service attack against sshd(8). [SA-14:25] Fix kernel stack disclosure in setlogin(2) / getlogin(2). [SA-14:26] Fix remote command execution in ftp(1). [EN-14:12] Fix NFSv4 and ZFS cache consistency issue. Approved by: so (des) git-svn-id: svn://svn.freebsd.org/base/releng/10.0@274110 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f --- UPDATING | 14 ++++++++ contrib/tnftp/src/fetch.c | 36 +++++++++++-------- secure/usr.sbin/sshd/Makefile | 10 ++++++ .../opensolaris/uts/common/fs/zfs/zfs_vnops.c | 1 + sys/conf/newvers.sh | 2 +- sys/kern/kern_prot.c | 31 ++++++++-------- 6 files changed, 64 insertions(+), 30 deletions(-) diff --git a/UPDATING b/UPDATING index ae276758..4d81f9e1 100644 --- a/UPDATING +++ b/UPDATING @@ -16,6 +16,20 @@ from older versions of FreeBSD, try WITHOUT_CLANG to bootstrap to the tip of stable/10, and then rebuild without this option. The bootstrap process from older version of current is a bit fragile. +20141104: p12 FreeBSD-SA-14:24.sshd + FreeBSD-SA-14:25.setlogin + FreeBSD-SA-14:26.ftp + FreeBSD-EN-14:12.zfs + + Fix denial of service attack against sshd(8). [SA-14:24] + + Fix kernel stack disclosure in setlogin(2) / getlogin(2). + [SA-14:25] + + Fix remote command execution in ftp(1). [SA-14:26] + + Fix NFSv4 and ZFS cache consistency issue. [EN-14:12] + 20141022: p11 FreeBSD-EN-14:10.tzdata Time zone data file update. [EN-14:10] diff --git a/contrib/tnftp/src/fetch.c b/contrib/tnftp/src/fetch.c index 91b49fd2..72153a54 100644 --- a/contrib/tnftp/src/fetch.c +++ b/contrib/tnftp/src/fetch.c @@ -547,7 +547,7 @@ fetch_url(const char *url, const char *proxyenv, char *proxyauth, char *wwwauth) url_decode(decodedpath); if (outfile) - savefile = ftp_strdup(outfile); + savefile = outfile; else { cp = strrchr(decodedpath, '/'); /* find savefile */ if (cp != NULL) @@ -571,8 +571,7 @@ fetch_url(const char *url, const char *proxyenv, char *proxyauth, char *wwwauth) rangestart = rangeend = entitylen = -1; mtime = -1; if (restartautofetch) { - if (strcmp(savefile, "-") != 0 && *savefile != '|' && - stat(savefile, &sb) == 0) + if (stat(savefile, &sb) == 0) restart_point = sb.st_size; } if (urltype == FILE_URL_T) { /* file:// URLs */ @@ -1098,17 +1097,25 @@ fetch_url(const char *url, const char *proxyenv, char *proxyauth, char *wwwauth) } /* end of ftp:// or http:// specific setup */ /* Open the output file. */ - if (strcmp(savefile, "-") == 0) { - fout = stdout; - } else if (*savefile == '|') { - oldintp = xsignal(SIGPIPE, SIG_IGN); - fout = popen(savefile + 1, "w"); - if (fout == NULL) { - warn("Can't execute `%s'", savefile + 1); - goto cleanup_fetch_url; + + /* + * Only trust filenames with special meaning if they came from + * the command line + */ + if (outfile == savefile) { + if (strcmp(savefile, "-") == 0) { + fout = stdout; + } else if (*savefile == '|') { + oldintp = xsignal(SIGPIPE, SIG_IGN); + fout = popen(savefile + 1, "w"); + if (fout == NULL) { + warn("Can't execute `%s'", savefile + 1); + goto cleanup_fetch_url; + } + closefunc = pclose; } - closefunc = pclose; - } else { + } + if (fout == NULL) { if ((rangeend != -1 && rangeend <= restart_point) || (rangestart == -1 && filesize != -1 && filesize <= restart_point)) { /* already done */ @@ -1318,7 +1325,8 @@ fetch_url(const char *url, const char *proxyenv, char *proxyauth, char *wwwauth) (*closefunc)(fout); if (res0) freeaddrinfo(res0); - FREEPTR(savefile); + if (savefile != outfile) + FREEPTR(savefile); FREEPTR(uuser); if (pass != NULL) memset(pass, 0, strlen(pass)); diff --git a/secure/usr.sbin/sshd/Makefile b/secure/usr.sbin/sshd/Makefile index 587eb673..213c53e2 100644 --- a/secure/usr.sbin/sshd/Makefile +++ b/secure/usr.sbin/sshd/Makefile @@ -56,6 +56,16 @@ CFLAGS+= -DNONE_CIPHER_ENABLED DPADD+= ${LIBCRYPT} ${LIBCRYPTO} ${LIBZ} LDADD+= -lcrypt -lcrypto -lz +# Fix the order of NEEDED entries for libthr and libc. The libthr +# needs to interpose libc symbols, leaving the libthr loading as +# dependency of krb causes reversed order and broken interposing. Put +# the threading library last on the linker command line, just before +# the -lc added by a compiler driver. +.if ${MK_KERBEROS_SUPPORT} != "no" +DPADD+= ${LIBPTHREAD} +LDADD+= -lpthread +.endif + .if defined(LOCALBASE) CFLAGS+= -DXAUTH_PATH=\"${LOCALBASE}/bin/xauth\" .endif diff --git a/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_vnops.c b/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_vnops.c index 87d8d64d..602ef835 100644 --- a/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_vnops.c +++ b/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_vnops.c @@ -2822,6 +2822,7 @@ zfs_getattr(vnode_t *vp, vattr_t *vap, int flags, cred_t *cr, #endif vap->va_seq = zp->z_seq; vap->va_flags = 0; /* FreeBSD: Reset chflags(2) flags. */ + vap->va_filerev = zp->z_seq; /* * Add in any requested optional attributes and the create time. diff --git a/sys/conf/newvers.sh b/sys/conf/newvers.sh index cee44602..f75037a8 100644 --- a/sys/conf/newvers.sh +++ b/sys/conf/newvers.sh @@ -32,7 +32,7 @@ TYPE="FreeBSD" REVISION="10.0" -BRANCH="RELEASE-p11" +BRANCH="RELEASE-p12" if [ "X${BRANCH_OVERRIDE}" != "X" ]; then BRANCH=${BRANCH_OVERRIDE} fi diff --git a/sys/kern/kern_prot.c b/sys/kern/kern_prot.c index f99e0530..9f7325c0 100644 --- a/sys/kern/kern_prot.c +++ b/sys/kern/kern_prot.c @@ -2073,21 +2073,20 @@ struct getlogin_args { int sys_getlogin(struct thread *td, struct getlogin_args *uap) { - int error; char login[MAXLOGNAME]; struct proc *p = td->td_proc; + size_t len; if (uap->namelen > MAXLOGNAME) uap->namelen = MAXLOGNAME; PROC_LOCK(p); SESS_LOCK(p->p_session); - bcopy(p->p_session->s_login, login, uap->namelen); + len = strlcpy(login, p->p_session->s_login, uap->namelen) + 1; SESS_UNLOCK(p->p_session); PROC_UNLOCK(p); - if (strlen(login) + 1 > uap->namelen) + if (len > uap->namelen) return (ERANGE); - error = copyout(login, uap->namebuf, uap->namelen); - return (error); + return (copyout(login, uap->namebuf, len)); } /* @@ -2106,21 +2105,23 @@ sys_setlogin(struct thread *td, struct setlogin_args *uap) int error; char logintmp[MAXLOGNAME]; + CTASSERT(sizeof(p->p_session->s_login) >= sizeof(logintmp)); + error = priv_check(td, PRIV_PROC_SETLOGIN); if (error) return (error); error = copyinstr(uap->namebuf, logintmp, sizeof(logintmp), NULL); - if (error == ENAMETOOLONG) - error = EINVAL; - else if (!error) { - PROC_LOCK(p); - SESS_LOCK(p->p_session); - (void) memcpy(p->p_session->s_login, logintmp, - sizeof(logintmp)); - SESS_UNLOCK(p->p_session); - PROC_UNLOCK(p); + if (error != 0) { + if (error == ENAMETOOLONG) + error = EINVAL; + return (error); } - return (error); + PROC_LOCK(p); + SESS_LOCK(p->p_session); + strcpy(p->p_session->s_login, logintmp); + SESS_UNLOCK(p->p_session); + PROC_UNLOCK(p); + return (0); } void -- 2.42.0