Date: Monday, February 25, 2013 @ 12:02:32 Author: tpowa Revision: 178533
upgpkg: linux 3.8-2 fix security issue Added: linux/trunk/CVE-2013-1763.patch Modified: linux/trunk/PKGBUILD linux/trunk/linux.install ---------------------+ CVE-2013-1763.patch | 35 +++++++++++++++++++++++++++++++++++ PKGBUILD | 18 ++++++++++++------ linux.install | 2 +- 3 files changed, 48 insertions(+), 7 deletions(-) Added: CVE-2013-1763.patch =================================================================== --- CVE-2013-1763.patch (rev 0) +++ CVE-2013-1763.patch 2013-02-25 11:02:32 UTC (rev 178533) @@ -0,0 +1,35 @@ +From 6e601a53566d84e1ffd25e7b6fe0b6894ffd79c0 Mon Sep 17 00:00:00 2001 +From: Mathias Krause <[email protected]> +Date: Sat, 23 Feb 2013 01:13:47 +0000 +Subject: [PATCH] sock_diag: Fix out-of-bounds access to sock_diag_handlers[] + +Userland can send a netlink message requesting SOCK_DIAG_BY_FAMILY +with a family greater or equal then AF_MAX -- the array size of +sock_diag_handlers[]. The current code does not test for this +condition therefore is vulnerable to an out-of-bound access opening +doors for a privilege escalation. + +Signed-off-by: Mathias Krause <[email protected]> +Acked-by: Eric Dumazet <[email protected]> +Signed-off-by: David S. Miller <[email protected]> +--- + net/core/sock_diag.c | 3 +++ + 1 files changed, 3 insertions(+), 0 deletions(-) + +diff --git a/net/core/sock_diag.c b/net/core/sock_diag.c +index 602cd63..750f44f 100644 +--- a/net/core/sock_diag.c ++++ b/net/core/sock_diag.c +@@ -121,6 +121,9 @@ static int __sock_diag_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh) + if (nlmsg_len(nlh) < sizeof(*req)) + return -EINVAL; + ++ if (req->sdiag_family >= AF_MAX) ++ return -EINVAL; ++ + hndl = sock_diag_lock_handler(req->sdiag_family); + if (hndl == NULL) + err = -ENOENT; +-- +1.7.6.5 + Modified: PKGBUILD =================================================================== --- PKGBUILD 2013-02-25 10:21:59 UTC (rev 178532) +++ PKGBUILD 2013-02-25 11:02:32 UTC (rev 178533) @@ -6,7 +6,7 @@ #pkgbase=linux-custom # Build kernel with a different name _srcname=linux-3.8 pkgver=3.8 -pkgrel=1 +pkgrel=2 arch=('i686' 'x86_64') url="http://www.kernel.org/"; license=('GPL2') @@ -18,12 +18,14 @@ 'config' 'config.x86_64' # standard config files for mkinitcpio ramdisk 'linux.preset' - 'change-default-console-loglevel.patch') + 'change-default-console-loglevel.patch' + 'CVE-2013-1763.patch') md5sums=('1c738edfc54e7c65faeb90c436104e2f' - '2e9010a91995b2f127ec8c26edded05d' - '09be44e718bf96264d245f2c2892d811' + '9710fb1b1e08eb1fc5214dc2fb34ebcc' + 'b2449cb9f5335fc864fe5b0a6330265a' 'eb14dcfd80c00852ef81ded6e826826a' - '9d3c56a4b999c8bfbd4018089a62f662') + '9d3c56a4b999c8bfbd4018089a62f662' + '420991808fe4cba143013427c0737aa9') _kernelname=${pkgbase#linux} @@ -36,6 +38,10 @@ # add latest fixes from stable queue, if needed # http://git.kernel.org/?p=linux/kernel/git/stable/stable-queue.git + # Fix security vulnetability CVE-2013-1763.patch + # https://bugs.archlinux.org/task/34005 + patch -Np1 -i "${srcdir}/CVE-2013-1763.patch" + # set DEFAULT_CONSOLE_LOGLEVEL to 4 (same value as the 'quiet' kernel param) # remove this when a Kconfig knob is made available by upstream # (relevant patch sent upstream: https://lkml.org/lkml/2011/7/26/227) @@ -171,7 +177,7 @@ mkdir -p "${pkgdir}/usr/src/linux-${_kernver}/include" - for i in acpi asm-generic config crypto drm generated linux math-emu \ + for i in acpi asm-generic config crypto drm generated keys linux math-emu \ media net pcmcia scsi sound trace uapi video xen; do cp -a include/${i} "${pkgdir}/usr/src/linux-${_kernver}/include/" done Modified: linux.install =================================================================== --- linux.install 2013-02-25 10:21:59 UTC (rev 178532) +++ linux.install 2013-02-25 11:02:32 UTC (rev 178533) @@ -2,7 +2,7 @@ # arg 2: the old package version KERNEL_NAME= -KERNEL_VERSION=3.8.0-1-ARCH +KERNEL_VERSION=3.8.0-2-ARCH # set a sane PATH to ensure that critical utils like depmod will be found export PATH='/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'
