Skip to Content.
Sympa Menu

sm-commit - [SM-Commit] GIT changes to master grimoire by Vlad Glagolev (3ca7ca1ec8eb7292590fba85bf282e5e2876dafe)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: Vlad Glagolev <scm AT sourcemage.org>
  • To: sm-commit AT lists.ibiblio.org
  • Subject: [SM-Commit] GIT changes to master grimoire by Vlad Glagolev (3ca7ca1ec8eb7292590fba85bf282e5e2876dafe)
  • Date: Sat, 17 Nov 2012 04:46:20 -0600

GIT changes to master grimoire by Vlad Glagolev <stealth AT sourcemage.org>:

graphics-libs/tiff/CVE-2012-4564.patch | 29
graphics-libs/tiff/DETAILS | 2
graphics-libs/tiff/HISTORY | 5
graphics-libs/tiff/PRE_BUILD | 4
kernels/linux/HISTORY | 3
kernels/linux/info/patches/maintenance_patches_3/patch-3.2.34 | 5
mail/exim/BUILD | 41
mail/exim/DETAILS | 6
mail/exim/FINAL | 3
mail/exim/HISTORY | 9
mail/exim/INSTALL | 5
mail/exim/PREPARE | 18
net/libproxy/BUILD | 2
net/libproxy/DETAILS | 1
net/libproxy/HISTORY | 5
python-pypi/roundup/DETAILS | 5
python-pypi/roundup/HISTORY | 3
utils/xen/DETAILS | 2
utils/xen/HISTORY | 7
utils/xen/PRE_BUILD | 6
utils/xen/xsa-20.patch | 38
utils/xen/xsa-21.patch | 31
utils/xen/xsa-22.patch | 40
utils/xen/xsa-23.patch | 32
utils/xen/xsa-24.patch | 26
utils/xen/xsa-25.patch | 461
++++++++++
26 files changed, 748 insertions(+), 41 deletions(-)

New commits:
commit 3ca7ca1ec8eb7292590fba85bf282e5e2876dafe
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

exim: => 4.80.1 (security)

commit 4b51ebd5b3c4a62df278a5e3ed598347550e059e
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

xen: security update

commit 8dec07e38ea380d0f1bf19f18061fcf14a056812
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

tiff: fixed CVE-2012-4564 (security)

commit c64071229575e42a5553c76226d6e5029dc54223
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

libproxy: security update

commit 36ecf941205ef888457b90cbd9479eae43ef332e
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

roundup: => 1.4.20 (security)

commit 03941634d87007ca5e6cbe8aa84c6ccc111fe23f
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

linux: => 3.2.34 (lts)

diff --git a/graphics-libs/tiff/CVE-2012-4564.patch
b/graphics-libs/tiff/CVE-2012-4564.patch
new file mode 100644
index 0000000..7b2f773
--- /dev/null
+++ b/graphics-libs/tiff/CVE-2012-4564.patch
@@ -0,0 +1,29 @@
+--- a/tools/ppm2tiff.c
++++ b/tools/ppm2tiff.c
+@@ -85,6 +85,7 @@
+ int c;
+ extern int optind;
+ extern char* optarg;
++ tmsize_t scanline_size;
+
+ if (argc < 2) {
+ fprintf(stderr, "%s: Too few arguments\n", argv[0]);
+@@ -233,8 +234,16 @@
+ }
+ if (TIFFScanlineSize(out) > linebytes)
+ buf = (unsigned char *)_TIFFmalloc(linebytes);
+- else
+- buf = (unsigned char *)_TIFFmalloc(TIFFScanlineSize(out));
++ else {
++ scanline_size = TIFFScanlineSize(out);
++ if (scanline_size != 0)
++ buf = (unsigned char
*)_TIFFmalloc(TIFFScanlineSize(out));
++ else {
++ fprintf(stderr, "%s: scanline size
overflow\n",infile);
++ (void) TIFFClose(out);
++ exit(-2);
++ }
++ }
+ if (resolution > 0) {
+ TIFFSetField(out, TIFFTAG_XRESOLUTION, resolution);
+ TIFFSetField(out, TIFFTAG_YRESOLUTION, resolution);
diff --git a/graphics-libs/tiff/DETAILS b/graphics-libs/tiff/DETAILS
index 76b311d..f592b56 100755
--- a/graphics-libs/tiff/DETAILS
+++ b/graphics-libs/tiff/DETAILS
@@ -1,5 +1,6 @@
SPELL=tiff
VERSION=4.0.3
+ SECURITY_PATCH=6
PATCHLEVEL=1

SOURCE_HASH=sha512:d80e18b00e9e696a30b954c0d92e5f2f773fd9a7a0a944cf6cabb69c1798e671506580daa1cd2ebf493ae922000170c2491dfc6d4c0a9cd0b865684070595a73
SOURCE=$SPELL-$VERSION.tar.gz
@@ -7,7 +8,6 @@ SOURCE_DIRECTORY="$BUILD_DIRECTORY/$SPELL-$VERSION"
SOURCE_URL[0]=ftp://ftp.remotesensing.org/pub/libtiff/$SOURCE
WEB_SITE=http://www.remotesensing.org/libtiff/
ENTERED=20010922
- SECURITY_PATCH=5
LICENSE[0]=LGPL
KEYWORDS="graphics libs"
SHORT="tiff provides support for the Tag Image File Format."
diff --git a/graphics-libs/tiff/HISTORY b/graphics-libs/tiff/HISTORY
index 20ddde0..64f440f 100644
--- a/graphics-libs/tiff/HISTORY
+++ b/graphics-libs/tiff/HISTORY
@@ -1,3 +1,8 @@
+2012-11-17 Vlad Glagolev <stealth AT sourcemage.org>
+ * DETAILS: SECURITY_PATCH++
+ * PRE_BUILD: added, to apply the patch
+ * CVE-2012-4564.patch: added, fixes CVE-2012-4564 security issue
+
2012-09-23 Treeve Jelbert <treeve AT sourcemage.org>
* DETAILS: version 4.0.3
SECURITY_PATCH++ : fixes CVE-2012-3401
diff --git a/graphics-libs/tiff/PRE_BUILD b/graphics-libs/tiff/PRE_BUILD
new file mode 100755
index 0000000..af23332
--- /dev/null
+++ b/graphics-libs/tiff/PRE_BUILD
@@ -0,0 +1,4 @@
+default_pre_build &&
+cd "$SOURCE_DIRECTORY" &&
+
+patch -p1 < "$SPELL_DIRECTORY/CVE-2012-4564.patch"
diff --git a/kernels/linux/HISTORY b/kernels/linux/HISTORY
index 06e84a4..74bc11f 100644
--- a/kernels/linux/HISTORY
+++ b/kernels/linux/HISTORY
@@ -1,3 +1,6 @@
+2012-11-17 Vlad Glagolev <stealth AT sourcemage.org>
+ * info/patches/maintenance_patches_3/patch-3.2.34: added
+
2012-11-05 Vlad Glagolev <stealth AT sourcemage.org>
* info/patches/maintenance_patches_3/patch-3.4.18: added
* info/patches/maintenance_patches_3/patch-3.0.51: added
diff --git a/kernels/linux/info/patches/maintenance_patches_3/patch-3.2.34
b/kernels/linux/info/patches/maintenance_patches_3/patch-3.2.34
new file mode 100755
index 0000000..7e174d4
--- /dev/null
+++ b/kernels/linux/info/patches/maintenance_patches_3/patch-3.2.34
@@ -0,0 +1,5 @@
+appliedkernels="3.2"
+patchversion="${appliedkernels}.34"
+source="patch-${patchversion}.bz2"
+source_url="${KERNEL_URL}/pub/linux/kernel/v3.x/${source}"
+sha1sum="64f4dafc30a40f4ef52fc9dffcef2cbe23ad3386"
diff --git a/mail/exim/BUILD b/mail/exim/BUILD
index afbabb3..a36d28e 100755
--- a/mail/exim/BUILD
+++ b/mail/exim/BUILD
@@ -1,33 +1,18 @@
create_account exim &&
create_account mail &&

-mkdir -p $INSTALL_ROOT/var/spool/mail &&
-chmod 1777 $INSTALL_ROOT/var/spool/mail &&
-chown exim:exim $INSTALL_ROOT/var/spool/mail &&
+# always correct permissions for older setups
+install -vm 2775 -d -o exim -g mail "$INSTALL_ROOT/var/spool/mail" &&

-if [[ -e $INSTALL_ROOT/var/spool/mail/db ]]
-then
- chown -R exim:exim $INSTALL_ROOT/var/spool/mail/db
-fi &&
-
-if [[ -e $INSTALL_ROOT/var/spool/mail/input ]]
-then
- chown -R exim:exim $INSTALL_ROOT/var/spool/mail/input
-fi &&
-
-if [[ -e $INSTALL_ROOT/var/spool/mail/log ]]
-then
- chown -R exim:exim $INSTALL_ROOT/var/spool/mail/log
-fi &&
-
-if [[ -e $INSTALL_ROOT/var/spool/mail/msglog ]]
-then
- chown -R exim:exim $INSTALL_ROOT/var/spool/mail/msglog
-fi &&
-
-chgrp -R exim $INSTALL_ROOT/var/spool/mail &&
+for maildir in db input msglog; do
+ if [[ -e $INSTALL_ROOT/var/spool/mail/$maildir ]]; then
+ chown -R exim:exim "$INSTALL_ROOT/var/spool/mail/$maildir"
+ else
+ install -vm 770 -d -o exim -g exim
"$INSTALL_ROOT/var/spool/mail/$maildir"
+ fi
+done &&

-mkdir -p Local &&
+mkdir -vp Local &&

if list_find "$OPTS" '--enable-x11-monitor'; then
cp src/EDITME Local/Makefile &&
@@ -191,5 +176,7 @@ echo "EXIM_GROUP=exim" >>
Local/Makefile &&
echo "PCRE_LIBS=-lpcre" >> Local/Makefile &&

sedit 's:tail \-1:tail \-n 1:' scripts/Configure-config.h &&
-make_single &&
-make
+
+make_single &&
+make &&
+make_normal
diff --git a/mail/exim/DETAILS b/mail/exim/DETAILS
index 6797df4..48f1354 100755
--- a/mail/exim/DETAILS
+++ b/mail/exim/DETAILS
@@ -1,12 +1,12 @@
SPELL=exim
- VERSION=4.77
- SECURITY_PATCH=6
+ VERSION=4.80.1
+ SECURITY_PATCH=7
SOURCE=$SPELL-$VERSION.tar.bz2
SOURCE2=$SOURCE.asc
SOURCE_GPG="exim.gpg:$SOURCE2:VERIFIED_UPSTREAM_KEY"
SOURCE2_IGNORE=signature
SOURCE_DIRECTORY="$BUILD_DIRECTORY/$SPELL-$VERSION"
- SOURCE_SUBURI="exim/exim4/old"
+ SOURCE_SUBURI="exim/exim4"
if [[ "$EXIM_MIRRORS" == "austria" ]]; then
SOURCE_URL[0]=ftp://exim.inode.at/$SOURCE_SUBURI/$SOURCE
SOURCE2_URL[0]=ftp://exim.inode.at/$SOURCE_SUBURI/$SOURCE2
diff --git a/mail/exim/FINAL b/mail/exim/FINAL
index 801e9f7..d3bf9fe 100755
--- a/mail/exim/FINAL
+++ b/mail/exim/FINAL
@@ -1,6 +1,3 @@
-chgrp -R mail $INSTALL_ROOT/var/spool/mail &&
-chmod -R g+rw $INSTALL_ROOT/var/spool/mail &&
-
EXIM_SCHEDULE="0 * * * * /usr/sbin/exim -q" &&

if [ "$FCRON" == "y" ]
diff --git a/mail/exim/HISTORY b/mail/exim/HISTORY
index 6c899d9..345683d 100644
--- a/mail/exim/HISTORY
+++ b/mail/exim/HISTORY
@@ -1,3 +1,12 @@
+2012-11-17 Vlad Glagolev <stealth AT sourcemage.org>
+ * DETAILS: updated spell to 4.80.1; SECURITY_PATCH++; updated source
uri
+ * PREPARE: added query for 4.80 migration
+ * INSTALL: use 'default_install', corrected typo
+ * FINAL: dropped recursive permission changes
+ * BUILD: moved 'make_normal' here, verbosity++; simplified permission
+ changes for exim-only dirs; changed default permissions on
+ /var/spool/mail from 1777 to safer 2775 for basic security reasons
+
2012-09-20 Vlad Glagolev <stealth AT sourcemage.org>
* DETAILS, PREPARE: fixed urls, dropped outdated & broken; quoting
paths

diff --git a/mail/exim/INSTALL b/mail/exim/INSTALL
index 07e1def..98275e0 100755
--- a/mail/exim/INSTALL
+++ b/mail/exim/INSTALL
@@ -1,7 +1,6 @@
-make_normal &&
-make install &&
+default_install &&

-# copy usefull convert tool
+# copy useful convert tool
message "Look @ /usr/doc/exim/doc for convert tools..." &&
cp -v src/convert*.src doc/ &&

diff --git a/mail/exim/PREPARE b/mail/exim/PREPARE
index b0bab5c..7ad2d99 100755
--- a/mail/exim/PREPARE
+++ b/mail/exim/PREPARE
@@ -1,3 +1,21 @@
+. "$GRIMOIRE/FUNCTIONS" &&
+
+local OLD_SPELL_VERSION="" &&
+if spell_ok $SPELL; then
+ OLD_SPELL_VERSION="$(installed_version $SPELL)"
+ if is_version_less "${OLD_SPELL_VERSION}" "4.80"; then
+ message "${PROBLEM_COLOR}" &&
+ message "This is backwards-incompatible update of Exim." &&
+ message "You need to check README.UPDATING file and ChangeLog of Exim
4.80"
+ message "carefully before continuing." &&
+ message "${DEFAULT_COLOR}" &&
+
+ if ! query "Do you wish to upgrade Exim now?" n; then
+ return 1
+ fi
+ fi
+fi &&
+
config_query_list EXIM_MIRRORS \
"Which group of exim mirrors would you like to use?" \
"austria" \
diff --git a/net/libproxy/BUILD b/net/libproxy/BUILD
index 1a1ed52..3bed602 100755
--- a/net/libproxy/BUILD
+++ b/net/libproxy/BUILD
@@ -1,5 +1,5 @@
if [ "$LIBPROXY_WEBKIT" == "none" ]; then
- OPTS="-DWITH_WEBKIT=0 $OPTS"
+ OPTS="-DWITH_WEBKIT=0 $OPTS"
fi &&

cmake_build
diff --git a/net/libproxy/DETAILS b/net/libproxy/DETAILS
index 94b9795..119376b 100755
--- a/net/libproxy/DETAILS
+++ b/net/libproxy/DETAILS
@@ -1,5 +1,6 @@
SPELL=libproxy
VERSION=0.4.10
+ SECURITY_PATCH=1

SOURCE_HASH=sha512:d7400740290bffb66ced317692f6b6fdb3e9973e48af1287df51dd3813706164ac6ee6970bde0f7b28beed4a6b6086bf957d85ec8c543e4c0af7044defb88e82
SOURCE="${SPELL}-${VERSION}.tar.gz"
SOURCE_URL[0]=http://libproxy.googlecode.com/files/${SOURCE}
diff --git a/net/libproxy/HISTORY b/net/libproxy/HISTORY
index 1233c01..16dd4cb 100644
--- a/net/libproxy/HISTORY
+++ b/net/libproxy/HISTORY
@@ -1,3 +1,8 @@
+2012-11-17 Vlad Glagolev <stealth AT sourcemage.org>
+ * DETAILS: this was a security update (at least CVE-2012-4504);
+ SECURITY_PATCH=1
+ * BUILD: cleaned up
+
2012-11-16 Treeve Jelbert <treeve AT sourcemage.org>
* DETAILS: version 0.4.10
* PRE_BUILD, unistd.patch: deleted
diff --git a/python-pypi/roundup/DETAILS b/python-pypi/roundup/DETAILS
index 5b77700..dcfa844 100755
--- a/python-pypi/roundup/DETAILS
+++ b/python-pypi/roundup/DETAILS
@@ -1,8 +1,9 @@
SPELL=roundup
- VERSION=1.4.19
+ VERSION=1.4.20
+ SECURITY_PATCH=1
SOURCE=$SPELL-$VERSION.tar.gz
SOURCE_URL[0]=http://pypi.python.org/packages/source/r/$SPELL/$SOURCE
-
SOURCE_HASH=sha512:497cad23e1074e535cf2729d52f07ec2103c89e5c0927be678f02299c036dac6dc262fe909310e066588f00144151b98b55a7dfd8c1df28680f99fecc255236e
+
SOURCE_HASH=sha512:62a1ca744afb7e17a4e165d695e1623d73810a3d3e6c374a4b73d010fcc3e93756ca0bfb6dc4cf7937acd1156c4b938e881e2e9ffd9b0c8e4c4366b730cc43b1
SOURCE_DIRECTORY="$BUILD_DIRECTORY/$SPELL-$VERSION"
WEB_SITE=http://roundup.sourceforge.net/
LICENSE[0]=PYTHON
diff --git a/python-pypi/roundup/HISTORY b/python-pypi/roundup/HISTORY
index 3c1016e..ac65baf 100644
--- a/python-pypi/roundup/HISTORY
+++ b/python-pypi/roundup/HISTORY
@@ -1,3 +1,6 @@
+2012-11-17 Vlad Glagolev <stealth AT sourcemage.org>
+ * DETAILS: updated spell to 1.4.20; SECURITY_PATCH++
+
2011-07-16 Vlad Glagolev <stealth AT sourcemage.org>
* DETAILS: updated spell to 1.4.19

diff --git a/utils/xen/DETAILS b/utils/xen/DETAILS
index e04dcd6..b6a56f2 100755
--- a/utils/xen/DETAILS
+++ b/utils/xen/DETAILS
@@ -1,6 +1,6 @@
SPELL=xen
VERSION=4.1.3
- SECURITY_PATCH=2
+ SECURITY_PATCH=3
SOURCE=${SPELL}-${VERSION}.tar.gz
SOURCE2=$SOURCE.sig
SOURCE2_IGNORE=signature
diff --git a/utils/xen/HISTORY b/utils/xen/HISTORY
index 7ce226d..72ba730 100644
--- a/utils/xen/HISTORY
+++ b/utils/xen/HISTORY
@@ -1,3 +1,10 @@
+2012-11-17 Vlad Glagolev <stealth AT sourcemage.org>
+ * DETAILS: SECURITY_PATCH++
+ * PRE_BUILD: apply patches
+ * xsa-{20-25}.patch: added, to fix CVE-2012-4535, CVE-2012-4536,
+ CVE-2012-4537, CVE-2012-4538, CVE-2012-4539, CVE-2012-4544,
+ CVE-2012-2625
+
2012-08-19 Vlad Glagolev <stealth AT sourcemage.org>
* DETAILS: SECURITY_PATCH++
* xsa-19.patch: added, to fix CVE-2012-4411
diff --git a/utils/xen/PRE_BUILD b/utils/xen/PRE_BUILD
index 4a7ade4..ec73184 100755
--- a/utils/xen/PRE_BUILD
+++ b/utils/xen/PRE_BUILD
@@ -2,6 +2,12 @@ default_pre_build &&
cd ${SOURCE_DIRECTORY} &&

patch -p0 < "$SPELL_DIRECTORY/xsa-19.patch" &&
+patch -p1 < "$SPELL_DIRECTORY/xsa-20.patch" &&
+patch -p1 < "$SPELL_DIRECTORY/xsa-21.patch" &&
+patch -p1 < "$SPELL_DIRECTORY/xsa-22.patch" &&
+patch -p1 < "$SPELL_DIRECTORY/xsa-23.patch" &&
+patch -p1 < "$SPELL_DIRECTORY/xsa-24.patch" &&
+patch -p1 < "$SPELL_DIRECTORY/xsa-25.patch" &&

if [[ $XEN_UPINIT != y ]]; then
sedit "s:all install-initd:all:" tools/hotplug/Linux/Makefile
diff --git a/utils/xen/xsa-20.patch b/utils/xen/xsa-20.patch
new file mode 100644
index 0000000..bedd318
--- /dev/null
+++ b/utils/xen/xsa-20.patch
@@ -0,0 +1,38 @@
+VCPU/timers: Prevent overflow in calculations, leading to DoS vulnerability
+
+The timer action for a vcpu periodic timer is to calculate the next
+expiry time, and to reinsert itself into the timer queue. If the
+deadline ends up in the past, Xen never leaves __do_softirq(). The
+affected PCPU will stay in an infinite loop until Xen is killed by the
+watchdog (if enabled).
+
+This is a security problem, XSA-20 / CVE-2012-4535.
+
+Signed-off-by: Andrew Cooper <andrew.cooper3 AT citrix.com>
+Acked-by: Ian Campbell <ian.campbell AT citrix.com>
+
+diff -r 478ba3f146df xen/common/domain.c
+--- a/xen/common/domain.c
++++ b/xen/common/domain.c
+@@ -903,6 +903,9 @@ long do_vcpu_op(int cmd, int vcpuid, XEN
+ if ( set.period_ns < MILLISECS(1) )
+ return -EINVAL;
+
++ if ( set.period_ns > STIME_DELTA_MAX )
++ return -EINVAL;
++
+ v->periodic_period = set.period_ns;
+ vcpu_force_reschedule(v);
+
+diff -r 478ba3f146df xen/include/xen/time.h
+--- a/xen/include/xen/time.h
++++ b/xen/include/xen/time.h
+@@ -55,6 +55,8 @@ struct tm gmtime(unsigned long t);
+ #define MILLISECS(_ms) ((s_time_t)((_ms) * 1000000ULL))
+ #define MICROSECS(_us) ((s_time_t)((_us) * 1000ULL))
+ #define STIME_MAX ((s_time_t)((uint64_t)~0ull>>1))
++/* Chosen so (NOW() + delta) wont overflow without an uptime of 200 years */
++#define STIME_DELTA_MAX ((s_time_t)((uint64_t)~0ull>>2))
+
+ extern void update_vcpu_system_time(struct vcpu *v);
+ extern void update_domain_wallclock_time(struct domain *d);
diff --git a/utils/xen/xsa-21.patch b/utils/xen/xsa-21.patch
new file mode 100644
index 0000000..14158ef
--- /dev/null
+++ b/utils/xen/xsa-21.patch
@@ -0,0 +1,31 @@
+x86/physdev: Range check pirq parameter from guests
+
+Otherwise Xen will read beyond either end of the struct
+domain.arch.pirq_emuirq array, usually resulting in a fatal page fault.
+
+This vulnerability was introduced by c/s 23241:d21100f1d00e, which adds
+a call to domain_pirq_to_emuirq() which uses the guest provided pirq
+value before range checking it, and was fixed by c/s 23573:584c2e5e03d9
+which changed the behaviour of the domain_pirq_to_emuirq() macro to use
+radix trees instead of a flat array.
+
+This is XSA-21 / CVE-2012-4536.
+
+Signed-off-by: Andrew Cooper <andrew.cooper3 AT citrix.com>
+Acked-by: Jan Beulich <jbeulich AT suse.com>
+Acked-by: Ian Campbell <ian.campbell AT citrix.com>
+
+diff -r 7a401a73d86d xen/arch/x86/physdev.c
+--- a/xen/arch/x86/physdev.c
++++ b/xen/arch/x86/physdev.c
+@@ -234,6 +234,10 @@ static int physdev_unmap_pirq(struct phy
+ if ( ret )
+ return ret;
+
++ ret = -EINVAL;
++ if ( unmap->pirq < 0 || unmap->pirq >= d->nr_pirqs )
++ goto free_domain;
++
+ if ( is_hvm_domain(d) )
+ {
+ spin_lock(&d->event_lock);
diff --git a/utils/xen/xsa-22.patch b/utils/xen/xsa-22.patch
new file mode 100644
index 0000000..bb2b88e
--- /dev/null
+++ b/utils/xen/xsa-22.patch
@@ -0,0 +1,40 @@
+x86/physmap: Prevent incorrect updates of m2p mappings
+
+In certain conditions, such as low memory, set_p2m_entry() can fail.
+Currently, the p2m and m2p tables will get out of sync because we still
+update the m2p table after the p2m update has failed.
+
+If that happens, subsequent guest-invoked memory operations can cause
+BUG()s and ASSERT()s to kill Xen.
+
+This is fixed by only updating the m2p table iff the p2m was
+successfully updated.
+
+This is a security problem, XSA-22 / CVE-2012-4537.
+
+Signed-off-by: Andrew Cooper <andrew.cooper3 AT citrix.com>
+Acked-by: Ian Campbell <ian.campbell AT citrix.com>
+Acked-by: Ian Jackson <ian.jackson AT eu.citrix.com>
+
+diff -r 3a27f4e44b6a xen/arch/x86/mm/p2m.c
+--- a/xen/arch/x86/mm/p2m.c
++++ b/xen/arch/x86/mm/p2m.c
+@@ -2558,7 +2558,10 @@ guest_physmap_add_entry(struct p2m_domai
+ if ( mfn_valid(_mfn(mfn)) )
+ {
+ if ( !set_p2m_entry(p2m, gfn, _mfn(mfn), page_order, t,
p2m->default_access) )
++ {
+ rc = -EINVAL;
++ goto out; /* Failed to update p2m, bail without updating m2p. */
++ }
+ if ( !p2m_is_grant(t) )
+ {
+ for ( i = 0; i < (1UL << page_order); i++ )
+@@ -2579,6 +2582,7 @@ guest_physmap_add_entry(struct p2m_domai
+ }
+ }
+
++out:
+ audit_p2m(p2m, 1);
+ p2m_unlock(p2m);
+
diff --git a/utils/xen/xsa-23.patch b/utils/xen/xsa-23.patch
new file mode 100644
index 0000000..82cb8b9
--- /dev/null
+++ b/utils/xen/xsa-23.patch
@@ -0,0 +1,32 @@
+xen/mm/shadow: check toplevel pagetables are present before unhooking them.
+
+If the guest has not fully populated its top-level PAE entries when it calls
+HVMOP_pagetable_dying, the shadow code could try to unhook entries from
+MFN 0. Add a check to avoid that case.
+
+This issue was introduced by c/s 21239:b9d2db109cf5.
+
+This is a security problem, XSA-23 / CVE-2012-4538.
+
+Signed-off-by: Tim Deegan <tim AT xen.org>
+Tested-by: Andrew Cooper <andrew.cooper3 AT citrix.com>
+Acked-by: Ian Campbell <ian.campbell AT citrix.com>
+
+diff -r bfd22d40db06 xen/arch/x86/mm/shadow/multi.c
+--- a/xen/arch/x86/mm/shadow/multi.c
++++ b/xen/arch/x86/mm/shadow/multi.c
+@@ -4737,8 +4737,12 @@ static void sh_pagetable_dying(struct vc
+ }
+ for ( i = 0; i < 4; i++ )
+ {
+- if ( fast_path )
+- smfn = _mfn(pagetable_get_pfn(v->arch.shadow_table[i]));
++ if ( fast_path ) {
++ if ( pagetable_is_null(v->arch.shadow_table[i]) )
++ smfn = _mfn(INVALID_MFN);
++ else
++ smfn = _mfn(pagetable_get_pfn(v->arch.shadow_table[i]));
++ }
+ else
+ {
+ /* retrieving the l2s */
diff --git a/utils/xen/xsa-24.patch b/utils/xen/xsa-24.patch
new file mode 100644
index 0000000..e46f513
--- /dev/null
+++ b/utils/xen/xsa-24.patch
@@ -0,0 +1,26 @@
+compat/gnttab: Prevent infinite loop in compat code
+
+c/s 20281:95ea2052b41b, which introduces Grant Table version 2
+hypercalls introduces a vulnerability whereby the compat hypercall
+handler can fall into an infinite loop.
+
+If the watchdog is enabled, Xen will die after the timeout.
+
+This is a security problem, XSA-24 / CVE-2012-4539.
+
+Signed-off-by: Andrew Cooper <andrew.cooper3 AT citrix.com>
+Acked-by: Jan Beulich <jbeulich AT suse.com>
+Acked-by: Ian Jackson <ian.jackson AT eu.citrix.com>
+
+diff -r bac883cf805a xen/common/compat/grant_table.c
+--- a/xen/common/compat/grant_table.c
++++ b/xen/common/compat/grant_table.c
+@@ -318,6 +318,8 @@ int compat_grant_table_op(unsigned int c
+ #undef XLAT_gnttab_get_status_frames_HNDL_frame_list
+ if ( unlikely(__copy_to_guest(cmp_uop, &cmp.get_status, 1))
)
+ rc = -EFAULT;
++ else
++ i = 1;
+ }
+ break;
+ }
diff --git a/utils/xen/xsa-25.patch b/utils/xen/xsa-25.patch
new file mode 100644
index 0000000..f8a9be2
--- /dev/null
+++ b/utils/xen/xsa-25.patch
@@ -0,0 +1,461 @@
+libxc: builder: limit maximum size of kernel/ramdisk.
+
+Allowing user supplied kernels of arbitrary sizes, especially during
+decompression, can swallow up dom0 memory leading to either virtual
+address space exhaustion in the builder process or allocation
+failures/OOM killing of both toolstack and unrelated processes.
+
+We disable these checks when building in a stub domain for pvgrub
+since this uses the guest's own memory and is isolated.
+
+Decompression of gzip compressed kernels and ramdisks has been safe
+since 14954:58205257517d (Xen 3.1.0 onwards).
+
+This is XSA-25 / CVE-2012-4544.
+
+Also make explicit checks for buffer overflows in various
+decompression routines. These were already ruled out due to other
+properties of the code but check them as a belt-and-braces measure.
+
+Signed-off-by: Ian Campbell <ian.campbell AT citrix.com>
+Acked-by: Ian Jackson <ian.jackson AT eu.citrix.com>
+[ Includes 25589:60f09d1ab1fe for CVE-2012-2625 ]
+
+diff --git a/stubdom/grub/kexec.c b/stubdom/grub/kexec.c
+index 06bef52..b21c91a 100644
+--- a/stubdom/grub/kexec.c
++++ b/stubdom/grub/kexec.c
+@@ -137,6 +137,10 @@ void kexec(void *kernel, long kernel_size, void
*module, long module_size, char
+ dom = xc_dom_allocate(xc_handle, cmdline, features);
+ dom->allocate = kexec_allocate;
+
++ /* We are using guest owned memory, therefore no limits. */
++ xc_dom_kernel_max_size(dom, 0);
++ xc_dom_ramdisk_max_size(dom, 0);
++
+ dom->kernel_blob = kernel;
+ dom->kernel_size = kernel_size;
+
+diff --git a/tools/libxc/xc_dom.h b/tools/libxc/xc_dom.h
+index e72f066..7043f96 100644
+--- a/tools/libxc/xc_dom.h
++++ b/tools/libxc/xc_dom.h
+@@ -52,6 +52,9 @@ struct xc_dom_image {
+ void *ramdisk_blob;
+ size_t ramdisk_size;
+
++ size_t max_kernel_size;
++ size_t max_ramdisk_size;
++
+ /* arguments and parameters */
+ char *cmdline;
+ uint32_t f_requested[XENFEAT_NR_SUBMAPS];
+@@ -175,6 +178,23 @@ void xc_dom_release_phys(struct xc_dom_image *dom);
+ void xc_dom_release(struct xc_dom_image *dom);
+ int xc_dom_mem_init(struct xc_dom_image *dom, unsigned int mem_mb);
+
++/* Set this larger if you have enormous ramdisks/kernels. Note that
++ * you should trust all kernels not to be maliciously large (e.g. to
++ * exhaust all dom0 memory) if you do this (see CVE-2012-4544 /
++ * XSA-25). You can also set the default independently for
++ * ramdisks/kernels in xc_dom_allocate() or call
++ * xc_dom_{kernel,ramdisk}_max_size.
++ */
++#ifndef XC_DOM_DECOMPRESS_MAX
++#define XC_DOM_DECOMPRESS_MAX (1024*1024*1024) /* 1GB */
++#endif
++
++int xc_dom_kernel_check_size(struct xc_dom_image *dom, size_t sz);
++int xc_dom_kernel_max_size(struct xc_dom_image *dom, size_t sz);
++
++int xc_dom_ramdisk_check_size(struct xc_dom_image *dom, size_t sz);
++int xc_dom_ramdisk_max_size(struct xc_dom_image *dom, size_t sz);
++
+ size_t xc_dom_check_gzip(xc_interface *xch,
+ void *blob, size_t ziplen);
+ int xc_dom_do_gunzip(xc_interface *xch,
+@@ -224,7 +244,8 @@ void xc_dom_log_memory_footprint(struct xc_dom_image
*dom);
+ void *xc_dom_malloc(struct xc_dom_image *dom, size_t size);
+ void *xc_dom_malloc_page_aligned(struct xc_dom_image *dom, size_t size);
+ void *xc_dom_malloc_filemap(struct xc_dom_image *dom,
+- const char *filename, size_t * size);
++ const char *filename, size_t * size,
++ const size_t max_size);
+ char *xc_dom_strdup(struct xc_dom_image *dom, const char *str);
+
+ /* --- alloc memory pool ------------------------------------------- */
+diff --git a/tools/libxc/xc_dom_bzimageloader.c
b/tools/libxc/xc_dom_bzimageloader.c
+index 9852e67..73cfad1 100644
+--- a/tools/libxc/xc_dom_bzimageloader.c
++++ b/tools/libxc/xc_dom_bzimageloader.c
+@@ -47,13 +47,19 @@ static int xc_try_bzip2_decode(
+ char *out_buf;
+ char *tmp_buf;
+ int retval = -1;
+- int outsize;
++ unsigned int outsize;
+ uint64_t total;
+
+ stream.bzalloc = NULL;
+ stream.bzfree = NULL;
+ stream.opaque = NULL;
+
++ if ( dom->kernel_size == 0)
++ {
++ DOMPRINTF("BZIP2: Input is 0 size");
++ return -1;
++ }
++
+ ret = BZ2_bzDecompressInit(&stream, 0, 0);
+ if ( ret != BZ_OK )
+ {
+@@ -66,6 +72,17 @@ static int xc_try_bzip2_decode(
+ * the input buffer to start, and we'll realloc as needed.
+ */
+ outsize = dom->kernel_size;
++
++ /*
++ * stream.avail_in and outsize are unsigned int, while kernel_size
++ * is a size_t. Check we aren't overflowing.
++ */
++ if ( outsize != dom->kernel_size )
++ {
++ DOMPRINTF("BZIP2: Input too large");
++ goto bzip2_cleanup;
++ }
++
+ out_buf = malloc(outsize);
+ if ( out_buf == NULL )
+ {
+@@ -98,13 +115,20 @@ static int xc_try_bzip2_decode(
+ if ( stream.avail_out == 0 )
+ {
+ /* Protect against output buffer overflow */
+- if ( outsize > INT_MAX / 2 )
++ if ( outsize > UINT_MAX / 2 )
+ {
+ DOMPRINTF("BZIP2: output buffer overflow");
+ free(out_buf);
+ goto bzip2_cleanup;
+ }
+
++ if ( xc_dom_kernel_check_size(dom, outsize * 2) )
++ {
++ DOMPRINTF("BZIP2: output too large");
++ free(out_buf);
++ goto bzip2_cleanup;
++ }
++
+ tmp_buf = realloc(out_buf, outsize * 2);
+ if ( tmp_buf == NULL )
+ {
+@@ -172,9 +196,15 @@ static int xc_try_lzma_decode(
+ unsigned char *out_buf;
+ unsigned char *tmp_buf;
+ int retval = -1;
+- int outsize;
++ size_t outsize;
+ const char *msg;
+
++ if ( dom->kernel_size == 0)
++ {
++ DOMPRINTF("LZMA: Input is 0 size");
++ return -1;
++ }
++
+ ret = lzma_alone_decoder(&stream, 128*1024*1024);
+ if ( ret != LZMA_OK )
+ {
+@@ -251,13 +281,20 @@ static int xc_try_lzma_decode(
+ if ( stream.avail_out == 0 )
+ {
+ /* Protect against output buffer overflow */
+- if ( outsize > INT_MAX / 2 )
++ if ( outsize > SIZE_MAX / 2 )
+ {
+ DOMPRINTF("LZMA: output buffer overflow");
+ free(out_buf);
+ goto lzma_cleanup;
+ }
+
++ if ( xc_dom_kernel_check_size(dom, outsize * 2) )
++ {
++ DOMPRINTF("LZMA: output too large");
++ free(out_buf);
++ goto lzma_cleanup;
++ }
++
+ tmp_buf = realloc(out_buf, outsize * 2);
+ if ( tmp_buf == NULL )
+ {
+@@ -327,6 +364,12 @@ static int xc_try_lzo1x_decode(
+ 0x89, 0x4c, 0x5a, 0x4f, 0x00, 0x0d, 0x0a, 0x1a, 0x0a
+ };
+
++ /*
++ * lzo_uint should match size_t. Check that this is the case to be
++ * sure we won't overflow various lzo_uint fields.
++ */
++ XC_BUILD_BUG_ON(sizeof(lzo_uint) != sizeof(size_t));
++
+ ret = lzo_init();
+ if ( ret != LZO_E_OK )
+ {
+@@ -406,6 +449,14 @@ static int xc_try_lzo1x_decode(
+ if ( src_len <= 0 || src_len > dst_len || src_len > left )
+ break;
+
++ msg = "Output buffer overflow";
++ if ( *size > SIZE_MAX - dst_len )
++ break;
++
++ msg = "Decompressed image too large";
++ if ( xc_dom_kernel_check_size(dom, *size + dst_len) )
++ break;
++
+ msg = "Failed to (re)alloc memory";
+ tmp_buf = realloc(out_buf, *size + dst_len);
+ if ( tmp_buf == NULL )
+diff --git a/tools/libxc/xc_dom_core.c b/tools/libxc/xc_dom_core.c
+index fea9de5..2a01d7c 100644
+--- a/tools/libxc/xc_dom_core.c
++++ b/tools/libxc/xc_dom_core.c
+@@ -159,7 +159,8 @@ void *xc_dom_malloc_page_aligned(struct xc_dom_image
*dom, size_t size)
+ }
+
+ void *xc_dom_malloc_filemap(struct xc_dom_image *dom,
+- const char *filename, size_t * size)
++ const char *filename, size_t * size,
++ const size_t max_size)
+ {
+ struct xc_dom_mem *block = NULL;
+ int fd = -1;
+@@ -171,6 +172,13 @@ void *xc_dom_malloc_filemap(struct xc_dom_image *dom,
+ lseek(fd, 0, SEEK_SET);
+ *size = lseek(fd, 0, SEEK_END);
+
++ if ( max_size && *size > max_size )
++ {
++ xc_dom_panic(dom->xch, XC_OUT_OF_MEMORY,
++ "tried to map file which is too large");
++ goto err;
++ }
++
+ block = malloc(sizeof(*block));
+ if ( block == NULL )
+ goto err;
+@@ -222,6 +230,40 @@ char *xc_dom_strdup(struct xc_dom_image *dom, const
char *str)
+ }
+
+ /* ------------------------------------------------------------------------
*/
++/* decompression buffer sizing
*/
++int xc_dom_kernel_check_size(struct xc_dom_image *dom, size_t sz)
++{
++ /* No limit */
++ if ( !dom->max_kernel_size )
++ return 0;
++
++ if ( sz > dom->max_kernel_size )
++ {
++ xc_dom_panic(dom->xch, XC_INVALID_KERNEL,
++ "kernel image too large");
++ return 1;
++ }
++
++ return 0;
++}
++
++int xc_dom_ramdisk_check_size(struct xc_dom_image *dom, size_t sz)
++{
++ /* No limit */
++ if ( !dom->max_ramdisk_size )
++ return 0;
++
++ if ( sz > dom->max_ramdisk_size )
++ {
++ xc_dom_panic(dom->xch, XC_INVALID_KERNEL,
++ "ramdisk image too large");
++ return 1;
++ }
++
++ return 0;
++}
++
++/* ------------------------------------------------------------------------
*/
+ /* read files, copy memory blocks, with transparent gunzip
*/
+
+ size_t xc_dom_check_gzip(xc_interface *xch, void *blob, size_t ziplen)
+@@ -235,7 +277,7 @@ size_t xc_dom_check_gzip(xc_interface *xch, void *blob,
size_t ziplen)
+
+ gzlen = blob + ziplen - 4;
+ unziplen = gzlen[3] << 24 | gzlen[2] << 16 | gzlen[1] << 8 | gzlen[0];
+- if ( (unziplen < 0) || (unziplen > (1024*1024*1024)) ) /* 1GB limit */
++ if ( (unziplen < 0) || (unziplen > XC_DOM_DECOMPRESS_MAX) )
+ {
+ xc_dom_printf
+ (xch,
+@@ -288,6 +330,9 @@ int xc_dom_try_gunzip(struct xc_dom_image *dom, void
**blob, size_t * size)
+ if ( unziplen == 0 )
+ return 0;
+
++ if ( xc_dom_kernel_check_size(dom, unziplen) )
++ return 0;
++
+ unzip = xc_dom_malloc(dom, unziplen);
+ if ( unzip == NULL )
+ return -1;
+@@ -588,6 +633,9 @@ struct xc_dom_image *xc_dom_allocate(xc_interface *xch,
+ memset(dom, 0, sizeof(*dom));
+ dom->xch = xch;
+
++ dom->max_kernel_size = XC_DOM_DECOMPRESS_MAX;
++ dom->max_ramdisk_size = XC_DOM_DECOMPRESS_MAX;
++
+ if ( cmdline )
+ dom->cmdline = xc_dom_strdup(dom, cmdline);
+ if ( features )
+@@ -608,10 +656,25 @@ struct xc_dom_image *xc_dom_allocate(xc_interface *xch,
+ return NULL;
+ }
+
++int xc_dom_kernel_max_size(struct xc_dom_image *dom, size_t sz)
++{
++ DOMPRINTF("%s: kernel_max_size=%zx", __FUNCTION__, sz);
++ dom->max_kernel_size = sz;
++ return 0;
++}
++
++int xc_dom_ramdisk_max_size(struct xc_dom_image *dom, size_t sz)
++{
++ DOMPRINTF("%s: ramdisk_max_size=%zx", __FUNCTION__, sz);
++ dom->max_ramdisk_size = sz;
++ return 0;
++}
++
+ int xc_dom_kernel_file(struct xc_dom_image *dom, const char *filename)
+ {
+ DOMPRINTF("%s: filename=\"%s\"", __FUNCTION__, filename);
+- dom->kernel_blob = xc_dom_malloc_filemap(dom, filename,
&dom->kernel_size);
++ dom->kernel_blob = xc_dom_malloc_filemap(dom, filename,
&dom->kernel_size,
++ dom->max_kernel_size);
+ if ( dom->kernel_blob == NULL )
+ return -1;
+ return xc_dom_try_gunzip(dom, &dom->kernel_blob, &dom->kernel_size);
+@@ -621,7 +684,9 @@ int xc_dom_ramdisk_file(struct xc_dom_image *dom, const
char *filename)
+ {
+ DOMPRINTF("%s: filename=\"%s\"", __FUNCTION__, filename);
+ dom->ramdisk_blob =
+- xc_dom_malloc_filemap(dom, filename, &dom->ramdisk_size);
++ xc_dom_malloc_filemap(dom, filename, &dom->ramdisk_size,
++ dom->max_ramdisk_size);
++
+ if ( dom->ramdisk_blob == NULL )
+ return -1;
+ // return xc_dom_try_gunzip(dom, &dom->ramdisk_blob, &dom->ramdisk_size);
+@@ -781,7 +846,11 @@ int xc_dom_build_image(struct xc_dom_image *dom)
+ void *ramdiskmap;
+
+ unziplen = xc_dom_check_gzip(dom->xch, dom->ramdisk_blob,
dom->ramdisk_size);
++ if ( xc_dom_ramdisk_check_size(dom, unziplen) != 0 )
++ unziplen = 0;
++
+ ramdisklen = unziplen ? unziplen : dom->ramdisk_size;
++
+ if ( xc_dom_alloc_segment(dom, &dom->ramdisk_seg, "ramdisk", 0,
+ ramdisklen) != 0 )
+ goto err;
+diff --git a/tools/pygrub/src/pygrub b/tools/pygrub/src/pygrub
+index 17c0083..1a3c1c3 100644
+--- a/tools/pygrub/src/pygrub
++++ b/tools/pygrub/src/pygrub
+@@ -28,6 +28,7 @@ import grub.LiloConf
+ import grub.ExtLinuxConf
+
+ PYGRUB_VER = 0.6
++FS_READ_MAX = 1024 * 1024
+
+ def enable_cursor(ison):
+ if ison:
+@@ -421,7 +422,8 @@ class Grub:
+ if self.__dict__.get('cf', None) is None:
+ raise RuntimeError, "couldn't find bootloader config file in
the image provided."
+ f = fs.open_file(self.cf.filename)
+- buf = f.read()
++ # limit read size to avoid pathological cases
++ buf = f.read(FS_READ_MAX)
+ del f
+ self.cf.parse(buf)
+
+@@ -670,6 +672,37 @@ if __name__ == "__main__":
+ def usage():
+ print >> sys.stderr, "Usage: %s [-q|--quiet] [-i|--interactive]
[-n|--not-really] [--output=] [--kernel=] [--ramdisk=] [--args=] [--entry=]
[--output-directory=] [--output-format=sxp|simple|simple0] <image>"
%(sys.argv[0],)
+
++ def copy_from_image(fs, file_to_read, file_type, output_directory,
++ not_really):
++ if not_really:
++ if fs.file_exists(file_to_read):
++ return "<%s:%s>" % (file_type, file_to_read)
++ else:
++ sys.exit("The requested %s file does not exist" % file_type)
++ try:
++ datafile = fs.open_file(file_to_read)
++ except Exception, e:
++ print >>sys.stderr, e
++ sys.exit("Error opening %s in guest" % file_to_read)
++ (tfd, ret) = tempfile.mkstemp(prefix="boot_"+file_type+".",
++ dir=output_directory)
++ dataoff = 0
++ while True:
++ data = datafile.read(FS_READ_MAX, dataoff)
++ if len(data) == 0:
++ os.close(tfd)
++ del datafile
++ return ret
++ try:
++ os.write(tfd, data)
++ except Exception, e:
++ print >>sys.stderr, e
++ os.close(tfd)
++ os.unlink(ret)
++ del datafile
++ sys.exit("Error writing temporary copy of "+file_type)
++ dataoff += len(data)
++
+ try:
+ opts, args = getopt.gnu_getopt(sys.argv[1:], 'qinh::',
+ ["quiet", "interactive", "not-really",
"help",
+@@ -786,24 +819,18 @@ if __name__ == "__main__":
+ if not fs:
+ raise RuntimeError, "Unable to find partition containing kernel"
+
+- if not_really:
+- bootcfg["kernel"] = "<kernel:%s>" % chosencfg["kernel"]
+- else:
+- data = fs.open_file(chosencfg["kernel"]).read()
+- (tfd, bootcfg["kernel"]) = tempfile.mkstemp(prefix="boot_kernel.",
+- dir=output_directory)
+- os.write(tfd, data)
+- os.close(tfd)
++ bootcfg["kernel"] = copy_from_image(fs, chosencfg["kernel"], "kernel",
++ output_directory, not_really)
+
+ if chosencfg["ramdisk"]:
+- if not_really:
+- bootcfg["ramdisk"] = "<ramdisk:%s>" % chosencfg["ramdisk"]
+- else:
+- data = fs.open_file(chosencfg["ramdisk"],).read()
+- (tfd, bootcfg["ramdisk"]) = tempfile.mkstemp(
+- prefix="boot_ramdisk.", dir=output_directory)
+- os.write(tfd, data)
+- os.close(tfd)
++ try:
++ bootcfg["ramdisk"] = copy_from_image(fs, chosencfg["ramdisk"],
++ "ramdisk",
output_directory,
++ not_really)
++ except:
++ if not not_really:
++ os.unlink(bootcfg["kernel"])
++ raise
+ else:
+ initrd = None
+



  • [SM-Commit] GIT changes to master grimoire by Vlad Glagolev (3ca7ca1ec8eb7292590fba85bf282e5e2876dafe), Vlad Glagolev, 11/17/2012

Archive powered by MHonArc 2.6.24.

Top of Page