diff options
| -rw-r--r-- | UPDATING | 7 | ||||
| -rw-r--r-- | crypto/openssh/auth-passwd.c | 5 | ||||
| -rw-r--r-- | sys/conf/newvers.sh | 2 | ||||
| -rw-r--r-- | sys/kern/sys_socket.c | 2 |
4 files changed, 15 insertions, 1 deletions
@@ -16,6 +16,13 @@ from older versions of FreeBSD, try WITHOUT_CLANG and WITH_GCC to bootstrap to the tip of head, and then rebuild without this option. The bootstrap process from older version of current across the gcc/clang cutover is a bit fragile. +20170810 p12 FreeBSD-SA-17:06.openssh + FreeBSD-EN-17:07.vnet + + Fix OpenSSH Denial of Service vulnerability. [SA-17:06] + + Fix VNET kernel panic with asynchronous I/O. [EN-17:07] + 20170712 p11 FreeBSD-SA-17:05.heimdal Fix heimdal KDC-REP service name validation vulnerability. diff --git a/crypto/openssh/auth-passwd.c b/crypto/openssh/auth-passwd.c index 63ccf3c..f6825ec 100644 --- a/crypto/openssh/auth-passwd.c +++ b/crypto/openssh/auth-passwd.c @@ -66,6 +66,8 @@ extern login_cap_t *lc; #define DAY (24L * 60 * 60) /* 1 day in seconds */ #define TWO_WEEKS (2L * 7 * DAY) /* 2 weeks in seconds */ +#define MAX_PASSWORD_LEN 1024 + void disable_forwarding(void) { @@ -87,6 +89,9 @@ auth_password(Authctxt *authctxt, const char *password) static int expire_checked = 0; #endif + if (strlen(password) > MAX_PASSWORD_LEN) + return 0; + #ifndef HAVE_CYGWIN if (pw->pw_uid == 0 && options.permit_root_login != PERMIT_YES) ok = 0; diff --git a/sys/conf/newvers.sh b/sys/conf/newvers.sh index d323326..9758ab2 100644 --- a/sys/conf/newvers.sh +++ b/sys/conf/newvers.sh @@ -32,7 +32,7 @@ TYPE="FreeBSD" REVISION="11.0" -BRANCH="RELEASE-p11" +BRANCH="RELEASE-p12" if [ -n "${BRANCH_OVERRIDE}" ]; then BRANCH=${BRANCH_OVERRIDE} fi diff --git a/sys/kern/sys_socket.c b/sys/kern/sys_socket.c index 80c55dd..2be2123 100644 --- a/sys/kern/sys_socket.c +++ b/sys/kern/sys_socket.c @@ -673,6 +673,7 @@ soaio_process_sb(struct socket *so, struct sockbuf *sb) { struct kaiocb *job; + CURVNET_SET(so->so_vnet); SOCKBUF_LOCK(sb); while (!TAILQ_EMPTY(&sb->sb_aiojobq) && soaio_ready(so, sb)) { job = TAILQ_FIRST(&sb->sb_aiojobq); @@ -696,6 +697,7 @@ soaio_process_sb(struct socket *so, struct sockbuf *sb) ACCEPT_LOCK(); SOCK_LOCK(so); sorele(so); + CURVNET_RESTORE(); } void |
