Author: delphij
Date: Thu Aug 10 06:59:26 2017
New Revision: 322343
URL: https://svnweb.freebsd.org/changeset/base/322343

Log:
  Fix OpenSSH Denial of Service vulnerability. [SA-17:06]
  
  Fix VNET kernel panic with asynchronous I/O. [EN-17:07]
  
  Approved by:  so

Modified:
  releng/11.0/UPDATING
  releng/11.0/crypto/openssh/auth-passwd.c
  releng/11.0/sys/conf/newvers.sh
  releng/11.0/sys/kern/sys_socket.c

Modified: releng/11.0/UPDATING
==============================================================================
--- releng/11.0/UPDATING        Thu Aug 10 06:59:07 2017        (r322342)
+++ releng/11.0/UPDATING        Thu Aug 10 06:59:26 2017        (r322343)
@@ -16,6 +16,13 @@ from older versions of FreeBSD, try WITHOUT_CLANG and 
 the tip of head, and then rebuild without this option. The bootstrap process
 from older version of current across the gcc/clang cutover is a bit fragile.
 
+20170810       p12     FreeBSD-SA-17:06.openssh
+                       FreeBSD-EN-17:07.vnet
+
+       Fix OpenSSH Denial of Service vulnerability. [SA-17:06]
+
+       Fix VNET kernel panic with asynchronous I/O. [EN-17:07]
+
 20170712       p11     FreeBSD-SA-17:05.heimdal
 
        Fix heimdal KDC-REP service name validation vulnerability.

Modified: releng/11.0/crypto/openssh/auth-passwd.c
==============================================================================
--- releng/11.0/crypto/openssh/auth-passwd.c    Thu Aug 10 06:59:07 2017        
(r322342)
+++ releng/11.0/crypto/openssh/auth-passwd.c    Thu Aug 10 06:59:26 2017        
(r322343)
@@ -66,6 +66,8 @@ extern login_cap_t *lc;
 #define DAY            (24L * 60 * 60) /* 1 day in seconds */
 #define TWO_WEEKS      (2L * 7 * DAY)  /* 2 weeks in seconds */
 
+#define MAX_PASSWORD_LEN       1024
+
 void
 disable_forwarding(void)
 {
@@ -86,6 +88,9 @@ auth_password(Authctxt *authctxt, const char *password
 #if defined(USE_SHADOW) && defined(HAS_SHADOW_EXPIRE)
        static int expire_checked = 0;
 #endif
+
+       if (strlen(password) > MAX_PASSWORD_LEN)
+               return 0;
 
 #ifndef HAVE_CYGWIN
        if (pw->pw_uid == 0 && options.permit_root_login != PERMIT_YES)

Modified: releng/11.0/sys/conf/newvers.sh
==============================================================================
--- releng/11.0/sys/conf/newvers.sh     Thu Aug 10 06:59:07 2017        
(r322342)
+++ releng/11.0/sys/conf/newvers.sh     Thu Aug 10 06:59:26 2017        
(r322343)
@@ -32,7 +32,7 @@
 
 TYPE="FreeBSD"
 REVISION="11.0"
-BRANCH="RELEASE-p11"
+BRANCH="RELEASE-p12"
 if [ -n "${BRANCH_OVERRIDE}" ]; then
        BRANCH=${BRANCH_OVERRIDE}
 fi

Modified: releng/11.0/sys/kern/sys_socket.c
==============================================================================
--- releng/11.0/sys/kern/sys_socket.c   Thu Aug 10 06:59:07 2017        
(r322342)
+++ releng/11.0/sys/kern/sys_socket.c   Thu Aug 10 06:59:26 2017        
(r322343)
@@ -673,6 +673,7 @@ soaio_process_sb(struct socket *so, struct sockbuf *sb
 {
        struct kaiocb *job;
 
+       CURVNET_SET(so->so_vnet);
        SOCKBUF_LOCK(sb);
        while (!TAILQ_EMPTY(&sb->sb_aiojobq) && soaio_ready(so, sb)) {
                job = TAILQ_FIRST(&sb->sb_aiojobq);
@@ -696,6 +697,7 @@ soaio_process_sb(struct socket *so, struct sockbuf *sb
        ACCEPT_LOCK();
        SOCK_LOCK(so);
        sorele(so);
+       CURVNET_RESTORE();
 }
 
 void
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"

Reply via email to