summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authordelphij <delphij@FreeBSD.org>2017-08-10 06:59:26 +0000
committerdelphij <delphij@FreeBSD.org>2017-08-10 06:59:26 +0000
commit82d137a0d8be5edd7243ab4a253b076ceb9f5633 (patch)
tree1398b970a9b8e825947bce39f4908bb775cc0cdb
parent348f5311d13a14a86bd5e73cfac8ac707498b87c (diff)
downloadFreeBSD-src-82d137a0d8be5edd7243ab4a253b076ceb9f5633.zip
FreeBSD-src-82d137a0d8be5edd7243ab4a253b076ceb9f5633.tar.gz
Fix OpenSSH Denial of Service vulnerability. [SA-17:06]releng/11.0
Fix VNET kernel panic with asynchronous I/O. [EN-17:07] Approved by: so
-rw-r--r--UPDATING7
-rw-r--r--crypto/openssh/auth-passwd.c5
-rw-r--r--sys/conf/newvers.sh2
-rw-r--r--sys/kern/sys_socket.c2
4 files changed, 15 insertions, 1 deletions
diff --git a/UPDATING b/UPDATING
index 1caeda5..fcdb27a 100644
--- a/UPDATING
+++ b/UPDATING
@@ -16,6 +16,13 @@ from older versions of FreeBSD, try WITHOUT_CLANG and WITH_GCC to bootstrap to
the tip of head, and then rebuild without this option. The bootstrap process
from older version of current across the gcc/clang cutover is a bit fragile.
+20170810 p12 FreeBSD-SA-17:06.openssh
+ FreeBSD-EN-17:07.vnet
+
+ Fix OpenSSH Denial of Service vulnerability. [SA-17:06]
+
+ Fix VNET kernel panic with asynchronous I/O. [EN-17:07]
+
20170712 p11 FreeBSD-SA-17:05.heimdal
Fix heimdal KDC-REP service name validation vulnerability.
diff --git a/crypto/openssh/auth-passwd.c b/crypto/openssh/auth-passwd.c
index 63ccf3c..f6825ec 100644
--- a/crypto/openssh/auth-passwd.c
+++ b/crypto/openssh/auth-passwd.c
@@ -66,6 +66,8 @@ extern login_cap_t *lc;
#define DAY (24L * 60 * 60) /* 1 day in seconds */
#define TWO_WEEKS (2L * 7 * DAY) /* 2 weeks in seconds */
+#define MAX_PASSWORD_LEN 1024
+
void
disable_forwarding(void)
{
@@ -87,6 +89,9 @@ auth_password(Authctxt *authctxt, const char *password)
static int expire_checked = 0;
#endif
+ if (strlen(password) > MAX_PASSWORD_LEN)
+ return 0;
+
#ifndef HAVE_CYGWIN
if (pw->pw_uid == 0 && options.permit_root_login != PERMIT_YES)
ok = 0;
diff --git a/sys/conf/newvers.sh b/sys/conf/newvers.sh
index d323326..9758ab2 100644
--- a/sys/conf/newvers.sh
+++ b/sys/conf/newvers.sh
@@ -32,7 +32,7 @@
TYPE="FreeBSD"
REVISION="11.0"
-BRANCH="RELEASE-p11"
+BRANCH="RELEASE-p12"
if [ -n "${BRANCH_OVERRIDE}" ]; then
BRANCH=${BRANCH_OVERRIDE}
fi
diff --git a/sys/kern/sys_socket.c b/sys/kern/sys_socket.c
index 80c55dd..2be2123 100644
--- a/sys/kern/sys_socket.c
+++ b/sys/kern/sys_socket.c
@@ -673,6 +673,7 @@ soaio_process_sb(struct socket *so, struct sockbuf *sb)
{
struct kaiocb *job;
+ CURVNET_SET(so->so_vnet);
SOCKBUF_LOCK(sb);
while (!TAILQ_EMPTY(&sb->sb_aiojobq) && soaio_ready(so, sb)) {
job = TAILQ_FIRST(&sb->sb_aiojobq);
@@ -696,6 +697,7 @@ soaio_process_sb(struct socket *so, struct sockbuf *sb)
ACCEPT_LOCK();
SOCK_LOCK(so);
sorele(so);
+ CURVNET_RESTORE();
}
void
OpenPOWER on IntegriCloud