New 2.6.18 security patches for testing

svn path=/patches/; revision=41

6 files changed, 389 insertions, 0 deletions

diff --git a/trunk/2.6.18/00000_README b/trunk/2.6.18/00000_README
index 2cd2f31..905c7e4 100644
--- a/trunk/2.6.18/00000_README
+++ b/trunk/2.6.18/00000_README
@@ -136,6 +136,31 @@ Patches
 30024_drm-i965.patch
     Dependency for 30022_i965-secure-batchbuffer.patch
 
+30025_ipv4-fib_props-out-of-bounds.patch
+    [SECURITY] Fix a typo which caused fib_props[] to be of the wrong size
+    and check for out of bounds condition in index provided by userspace
+    See CVE-2007-2172
+
+30027_cpuset_tasks-underflow.patch
+    [SECURITY] Fix integer underflow in /dev/cpuset/tasks which could allow
+    local attackers to read sensitive kernel memory if the cpuset filesystem
+    is mounted.
+    See CVE-2007-2875
+
+30028_random-bound-check-ordering.patch
+    [SECURITY] Fix stack-based buffer overflow in the random number
+    generator
+    See CVE-2007-3105
+
+30029_cifs-fix-sign-settings.patch
+    [SECURITY] Fix overriding the server to force signing on caused by
+    checking the wrong gloal variable.
+    See CVE-2007-3843
+
+30030_aacraid-ioctl-perm-check.patch
+    [SECURITY] Require admin capabilities to issue ioctls to aacraid devices
+    See CVE-2007-4308
+
 50001_make-install.patch
     Handle make install in a semi-sane way that plays nice with
     split domU/dom0 kernels.
diff --git a/trunk/2.6.18/30025_ipv4-fib_props-out-of-bounds.patch b/trunk/2.6.18/30025_ipv4-fib_props-out-of-bounds.patch
new file mode 100644
index 0000000..3fb091d
--- /dev/null
+++ b/trunk/2.6.18/30025_ipv4-fib_props-out-of-bounds.patch
@@ -0,0 +1,42 @@
+From: Thomas Graf <tgraf@suug.ch>
+Date: Sun, 25 Mar 2007 03:32:54 +0000 (-0700)
+Subject: [IPv4] fib: Fix out of bound access of fib_props[]
+X-Git-Tag: v2.6.21~241^2~12
+X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=a0ee18b9b7d3847976c6fb315c06a34fb296de0e
+
+[IPv4] fib: Fix out of bound access of fib_props[]
+
+Fixes a typo which caused fib_props[] to have the wrong size
+and makes sure the value used to index the array which is
+provided by userspace via netlink is checked to avoid out of
+bound access.
+
+Signed-off-by: Thomas Graf <tgraf@suug.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+
+Backported to Debian's 2.6.18 by dann frazier <dannf@debian.org>, heavily
+based upon Tim Gardner's backport for Ubuntu:
+  http://kernel.ubuntu.com/git?p=ubuntu/ubuntu-edgy.git;a=commitdiff;h=6e87288e83ac08e7154980795622efdafd49c9c8
+
+--- linux-source-2.6.18.orig/net/ipv4/fib_semantics.c	2006-09-19 21:42:06.000000000 -0600
++++ linux-source-2.6.18/net/ipv4/fib_semantics.c	2007-08-27 22:15:04.678316443 -0600
+@@ -88,7 +88,7 @@ static const struct 
+ {
+ 	int	error;
+ 	u8	scope;
+-} fib_props[RTA_MAX + 1] = {
++} fib_props[RTN_MAX + 1] = {
+         {
+ 		.error	= 0,
+ 		.scope	= RT_SCOPE_NOWHERE,
+@@ -662,6 +662,9 @@ fib_create_info(const struct rtmsg *r, s
+ 	u32 mp_alg = IP_MP_ALG_NONE;
+ #endif
+ 
++	if (r->rtm_type > RTN_MAX)
++		goto err_inval;
++
+ 	/* Fast check to catch the most weird cases */
+ 	if (fib_props[r->rtm_type].scope > r->rtm_scope)
+ 		goto err_inval;
diff --git a/trunk/2.6.18/30027_cpuset_tasks-underflow.patch b/trunk/2.6.18/30027_cpuset_tasks-underflow.patch
new file mode 100644
index 0000000..254ce0f
--- /dev/null
+++ b/trunk/2.6.18/30027_cpuset_tasks-underflow.patch
@@ -0,0 +1,61 @@
+From: Akinobu Mita <akinobu.mita@gmail.com>
+Date: Wed, 9 May 2007 09:33:33 +0000 (-0700)
+Subject: use simple_read_from_buffer in kernel/
+X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Fstable%2Flinux-2.6.20.y.git;a=commitdiff_plain;h=85badbdf5120d246ce2bb3f1a7689a805f9c9006
+
+use simple_read_from_buffer in kernel/
+
+Cleanup using simple_read_from_buffer() for /dev/cpuset/tasks and
+/proc/config.gz.
+
+Cc: Paul Jackson <pj@sgi.com>
+Cc: Randy Dunlap <rdunlap@xenotime.net>
+Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+---
+
+Backported to Debian's 2.6.18 by dann frazier <dannf@debian.org>
+
+diff -urpN linux-source-2.6.18.orig/kernel/configs.c linux-source-2.6.18/kernel/configs.c
+--- linux-source-2.6.18.orig/kernel/configs.c	2006-09-19 21:42:06.000000000 -0600
++++ linux-source-2.6.18/kernel/configs.c	2007-08-27 22:30:10.774211736 -0600
+@@ -61,18 +61,9 @@ static ssize_t
+ ikconfig_read_current(struct file *file, char __user *buf,
+ 		      size_t len, loff_t * offset)
+ {
+-	loff_t pos = *offset;
+-	ssize_t count;
+-
+-	if (pos >= kernel_config_data_size)
+-		return 0;
+-
+-	count = min(len, (size_t)(kernel_config_data_size - pos));
+-	if (copy_to_user(buf, kernel_config_data + MAGIC_SIZE + pos, count))
+-		return -EFAULT;
+-
+-	*offset += count;
+-	return count;
++	return simple_read_from_buffer(buf, len, offset,
++				       kernel_config_data + MAGIC_SIZE,
++				       kernel_config_data_size);
+ }
+ 
+ static struct file_operations ikconfig_file_ops = {
+diff -urpN linux-source-2.6.18.orig/kernel/cpuset.c linux-source-2.6.18/kernel/cpuset.c
+--- linux-source-2.6.18.orig/kernel/cpuset.c	2006-09-19 21:42:06.000000000 -0600
++++ linux-source-2.6.18/kernel/cpuset.c	2007-08-27 22:30:10.778211823 -0600
+@@ -1743,12 +1743,7 @@ static ssize_t cpuset_tasks_read(struct 
+ {
+ 	struct ctr_struct *ctr = file->private_data;
+ 
+-	if (*ppos + nbytes > ctr->bufsz)
+-		nbytes = ctr->bufsz - *ppos;
+-	if (copy_to_user(buf, ctr->buf + *ppos, nbytes))
+-		return -EFAULT;
+-	*ppos += nbytes;
+-	return nbytes;
++	return simple_read_from_buffer(buf, nbytes, ppos, ctr->buf, ctr->bufsz);
+ }
+ 
+ static int cpuset_tasks_release(struct inode *unused_inode, struct file *file)
diff --git a/trunk/2.6.18/30028_random-bound-check-ordering.patch b/trunk/2.6.18/30028_random-bound-check-ordering.patch
new file mode 100644
index 0000000..f2e9ab5
--- /dev/null
+++ b/trunk/2.6.18/30028_random-bound-check-ordering.patch
@@ -0,0 +1,42 @@
+From: Matt Mackall <mpm@selenic.com>
+Date: Thu, 19 Jul 2007 18:30:14 +0000 (-0700)
+Subject: random: fix bound check ordering (CVE-2007-3105)
+X-Git-Tag: v2.6.23-rc1~259
+X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=5a021e9ffd56c22700133ebc37d607f95be8f7bd
+
+random: fix bound check ordering (CVE-2007-3105)
+
+If root raised the default wakeup threshold over the size of the
+output pool, the pool transfer function could overflow the stack with
+RNG bytes, causing a DoS or potential privilege escalation.
+
+(Bug reported by the PaX Team <pageexec@freemail.hu>)
+
+Cc: Theodore Tso <tytso@mit.edu>
+Cc: Willy Tarreau <w@1wt.eu>
+Signed-off-by: Matt Mackall <mpm@selenic.com>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+---
+
+diff --git a/drivers/char/random.c b/drivers/char/random.c
+index 7f52712..397c714 100644
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -693,9 +693,14 @@ static void xfer_secondary_pool(struct entropy_store *r, size_t nbytes)
+ 
+ 	if (r->pull && r->entropy_count < nbytes * 8 &&
+ 	    r->entropy_count < r->poolinfo->POOLBITS) {
+-		int bytes = max_t(int, random_read_wakeup_thresh / 8,
+-				min_t(int, nbytes, sizeof(tmp)));
++		/* If we're limited, always leave two wakeup worth's BITS */
+ 		int rsvd = r->limit ? 0 : random_read_wakeup_thresh/4;
++		int bytes = nbytes;
++
++		/* pull at least as many as BYTES as wakeup BITS */
++		bytes = max_t(int, bytes, random_read_wakeup_thresh / 8);
++		/* but never more than the buffer size */
++		bytes = min_t(int, bytes, sizeof(tmp));
+ 
+ 		DEBUG_ENT("going to reseed %s with %d bits "
+ 			  "(%d of %d requested)\n",
diff --git a/trunk/2.6.18/30029_cifs-fix-sign-settings.patch b/trunk/2.6.18/30029_cifs-fix-sign-settings.patch
new file mode 100644
index 0000000..11f8021
--- /dev/null
+++ b/trunk/2.6.18/30029_cifs-fix-sign-settings.patch
@@ -0,0 +1,179 @@
+From: Steve French <sfrench@us.ibm.com>
+Date: Thu, 28 Jun 2007 18:41:42 +0000 (+0000)
+Subject: [CIFS] Fix sign mount option and sign proc config setting
+X-Git-Tag: v2.6.23-rc1~478^2~20
+X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=762e5ab77c803c819e45d054518a98efb70b0f60
+
+[CIFS] Fix sign mount option and sign proc config setting
+
+We were checking the wrong (old) global variable to determine
+whether to override server and force signing on the SMB
+connection.
+
+Acked-by: Dave Kleikamp <shaggy@austin.ibm.com>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+---
+
+Backported to Debian's 2.6.18 by dann frazier <dannf@debian.org>
+
+diff -urpN linux-source-2.6.18.orig/fs/cifs/cifs_debug.c linux-source-2.6.18/fs/cifs/cifs_debug.c
+--- linux-source-2.6.18.orig/fs/cifs/cifs_debug.c	2006-09-19 21:42:06.000000000 -0600
++++ linux-source-2.6.18/fs/cifs/cifs_debug.c	2007-08-27 23:12:40.666200121 -0600
+@@ -895,90 +895,14 @@ security_flags_write(struct file *file, 
+ 	}
+ 	/* flags look ok - update the global security flags for cifs module */
+ 	extended_security = flags;
++	if (extended_security & CIFSSEC_MUST_SIGN) {
++		/* requiring signing implies signing is allowed */
++		extended_security |= CIFSSEC_MAY_SIGN;
++		cFYI(1, ("packet signing now required"));
++	} else if ((extended_security & CIFSSEC_MAY_SIGN) == 0) {
++		cFYI(1, ("packet signing disabled"));
++	}
++	/* BB should we turn on MAY flags for other MUST options? */
+ 	return count;
+ }
+-
+-/* static int
+-ntlmv2_enabled_read(char *page, char **start, off_t off,
+-		       int count, int *eof, void *data)
+-{
+-	int len;
+-
+-	len = sprintf(page, "%d\n", ntlmv2_support);
+-
+-	len -= off;
+-	*start = page + off;
+-
+-	if (len > count)
+-		len = count;
+-	else
+-		*eof = 1;
+-
+-	if (len < 0)
+-		len = 0;
+-
+-	return len;
+-}
+-static int
+-ntlmv2_enabled_write(struct file *file, const char __user *buffer,
+-			unsigned long count, void *data)
+-{
+-	char c;
+-	int rc;
+-
+-	rc = get_user(c, buffer);
+-	if (rc)
+-		return rc;
+-	if (c == '0' || c == 'n' || c == 'N')
+-		ntlmv2_support = 0;
+-	else if (c == '1' || c == 'y' || c == 'Y')
+-		ntlmv2_support = 1;
+-	else if (c == '2')
+-		ntlmv2_support = 2;
+-
+-	return count;
+-}
+-
+-static int
+-packet_signing_enabled_read(char *page, char **start, off_t off,
+-		       int count, int *eof, void *data)
+-{
+-	int len;
+-
+-	len = sprintf(page, "%d\n", sign_CIFS_PDUs);
+-
+-	len -= off;
+-	*start = page + off;
+-
+-	if (len > count)
+-		len = count;
+-	else
+-		*eof = 1;
+-
+-	if (len < 0)
+-		len = 0;
+-
+-	return len;
+-}
+-static int
+-packet_signing_enabled_write(struct file *file, const char __user *buffer,
+-			unsigned long count, void *data)
+-{
+-	char c;
+-	int rc;
+-
+-	rc = get_user(c, buffer);
+-	if (rc)
+-		return rc;
+-	if (c == '0' || c == 'n' || c == 'N')
+-		sign_CIFS_PDUs = 0;
+-	else if (c == '1' || c == 'y' || c == 'Y')
+-		sign_CIFS_PDUs = 1;
+-	else if (c == '2')
+-		sign_CIFS_PDUs = 2;
+-
+-	return count;
+-} */
+-
+-
+ #endif
+diff -urpN linux-source-2.6.18.orig/fs/cifs/cifssmb.c linux-source-2.6.18/fs/cifs/cifssmb.c
+--- linux-source-2.6.18.orig/fs/cifs/cifssmb.c	2006-09-19 21:42:06.000000000 -0600
++++ linux-source-2.6.18/fs/cifs/cifssmb.c	2007-08-27 23:12:40.678200384 -0600
+@@ -411,11 +411,11 @@ CIFSSMBNegotiate(unsigned int xid, struc
+ 
+ 	/* if any of auth flags (ie not sign or seal) are overriden use them */
+ 	if(ses->overrideSecFlg & (~(CIFSSEC_MUST_SIGN | CIFSSEC_MUST_SEAL)))
+-		secFlags = ses->overrideSecFlg;
++		secFlags = ses->overrideSecFlg;  /* BB FIXME fix sign flags? */
+ 	else /* if override flags set only sign/seal OR them with global auth */
+ 		secFlags = extended_security | ses->overrideSecFlg;
+ 
+-	cFYI(1,("secFlags 0x%x",secFlags));
++	cFYI(1, ("secFlags 0x%x", secFlags));
+ 
+ 	pSMB->hdr.Mid = GetNextMid(server);
+ 	pSMB->hdr.Flags2 |= SMBFLG2_UNICODE;
+@@ -582,22 +582,32 @@ CIFSSMBNegotiate(unsigned int xid, struc
+ #ifdef CONFIG_CIFS_WEAK_PW_HASH
+ signing_check:
+ #endif
+-	if(sign_CIFS_PDUs == FALSE) {        
++	if ((secFlags & CIFSSEC_MAY_SIGN) == 0) {
++		/* MUST_SIGN already includes the MAY_SIGN FLAG
++		   so if this is zero it means that signing is disabled */
++		cFYI(1, ("Signing disabled"));
+ 		if(server->secMode & SECMODE_SIGN_REQUIRED)
+-			cERROR(1,("Server requires "
+-				 "/proc/fs/cifs/PacketSigningEnabled to be on"));
++			cERROR(1, ("Server requires "
++				   "/proc/fs/cifs/PacketSigningEnabled "
++				   "to be on"));
+ 		server->secMode &= 
+ 			~(SECMODE_SIGN_ENABLED | SECMODE_SIGN_REQUIRED);
+-	} else if(sign_CIFS_PDUs == 1) {
++	} else if ((secFlags & CIFSSEC_MUST_SIGN) == CIFSSEC_MUST_SIGN) {
++		/* signing required */
++		cFYI(1, ("Must sign - segFlags 0x%x", secFlags));
++		if ((server->secMode &
++			(SECMODE_SIGN_ENABLED | SECMODE_SIGN_REQUIRED)) == 0) {
++			cERROR(1,
++				("signing required but server lacks support"));
++		} else
++			server->secMode |= SECMODE_SIGN_REQUIRED;
++	} else {
++		/* signing optional ie CIFSSEC_MAY_SIGN */
+ 		if((server->secMode & SECMODE_SIGN_REQUIRED) == 0)
+ 			server->secMode &= 
+ 				~(SECMODE_SIGN_ENABLED | SECMODE_SIGN_REQUIRED);
+-	} else if(sign_CIFS_PDUs == 2) {
+-		if((server->secMode & 
+-			(SECMODE_SIGN_ENABLED | SECMODE_SIGN_REQUIRED)) == 0) {
+-			cERROR(1,("signing required but server lacks support"));
+-		}
+ 	}
++	
+ neg_err_exit:	
+ 	cifs_buf_release(pSMB);
+ 
diff --git a/trunk/2.6.18/30030_aacraid-ioctl-perm-check.patch b/trunk/2.6.18/30030_aacraid-ioctl-perm-check.patch
new file mode 100644
index 0000000..cb2a516
--- /dev/null
+++ b/trunk/2.6.18/30030_aacraid-ioctl-perm-check.patch
@@ -0,0 +1,40 @@
+From: Alan Cox <alan@lxorguk.ukuu.org.uk>
+Date: Mon, 23 Jul 2007 13:51:05 +0000 (+0100)
+Subject: [SCSI] aacraid: Fix security hole
+X-Git-Tag: v2.6.23-rc2~164^2~24
+X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=60395bb60e0b5e4e0808ac8eb07a92f6c9cdea1f
+
+[SCSI] aacraid: Fix security hole
+
+On the SCSI layer ioctl path there is no implicit permissions check for
+ioctls (and indeed other drivers implement unprivileged ioctls). aacraid
+however allows all sorts of very admin only things to be done so should
+check.
+
+Signed-off-by: Alan Cox <alan@redhat.com>
+Acked-by: "Salyzyn, Mark" <mark_salyzyn@adaptec.com>
+Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
+---
+
+Adjusted to apply to Debian's 2.6.18 by dann frazier <dannf@debian.org>
+
+--- linux-source-2.6.18.orig/drivers/scsi/aacraid/linit.c	2006-09-19 21:42:06.000000000 -0600
++++ linux-source-2.6.18/drivers/scsi/aacraid/linit.c	2007-08-27 23:27:41.805986591 -0600
+@@ -536,6 +536,8 @@ static int aac_cfg_open(struct inode *in
+ static int aac_cfg_ioctl(struct inode *inode,  struct file *file,
+ 		unsigned int cmd, unsigned long arg)
+ {
++	if (!capable(CAP_SYS_ADMIN))
++		return -EPERM;
+ 	return aac_do_ioctl(file->private_data, cmd, (void __user *)arg);
+ }
+ 
+@@ -589,6 +591,8 @@ static int aac_compat_ioctl(struct scsi_
+ 
+ static long aac_compat_cfg_ioctl(struct file *file, unsigned cmd, unsigned long arg)
+ {
++	if (!capable(CAP_SYS_ADMIN))
++		return -EPERM;
+ 	return aac_compat_do_ioctl((struct aac_dev *)file->private_data, cmd, arg);
+ }
+ #endif