d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix devfs rules not applied by default for jails.

Browse Source 
Fix OpenSSL use-after-free vulnerability.

Fix TCP reassembly vulnerability.

Security:	FreeBSD-SA-14:07.devfs
Security:	CVE-2014-3001
Security:	FreeBSD-SA-14:08.tcp
Security:	CVE-2014-3000
Security:	FreeBSD-SA-14:09.openssl
Security:	CVE-2010-5298
This commit is contained in:
delphij 2014-04-30 04:03:05 +00:00
parent 65035c2d37
commit acd7398463
4 changed files with 7 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
crypto/openssl/ssl/s3_pkt.c
View File

@ -1055,7 +1055,7 @@ start:
{
s->rstate=SSL_ST_READ_HEADER;
rr->off=0;
if (s->mode & SSL_MODE_RELEASE_BUFFERS)
if (s->mode & SSL_MODE_RELEASE_BUFFERS && s->s3->rbuf.left == 0)
ssl3_release_read_buffer(s);
}
}

2
etc/defaults/rc.conf
View File

@ -649,7 +649,7 @@ devfs_rulesets="/etc/defaults/devfs.rules /etc/devfs.rules" # Files containing
devfs_system_ruleset="" # The name (NOT number) of a ruleset to apply to /dev
devfs_set_rulesets="" # A list of /mount/dev=ruleset_name settings to
# apply (must be mounted already, i.e. fstab(5))
devfs_load_rulesets="NO" # Enable to always load the default rulesets
devfs_load_rulesets="YES" # Enable to always load the default rulesets
performance_cx_lowest="HIGH" # Online CPU idle state
performance_cpu_freq="NONE" # Online CPU frequency
economy_cx_lowest="HIGH" # Offline CPU idle state

7
sys/netinet/tcp_reass.c
View File

@ -205,7 +205,7 @@ tcp_reass(struct tcpcb *tp, struct tcphdr *th, int *tlenp, struct mbuf *m)
* Investigate why and re-evaluate the below limit after the behaviour
* is understood.
*/
if (th->th_seq != tp->rcv_nxt &&
if ((th->th_seq != tp->rcv_nxt || !TCPS_HAVEESTABLISHED(tp->t_state)) &&
tp->t_segqlen >= (so->so_rcv.sb_hiwat / tp->t_maxseg) + 1) {
V_tcp_reass_overflows++;
TCPSTAT_INC(tcps_rcvmemdrop);
@ -228,7 +228,7 @@ tcp_reass(struct tcpcb *tp, struct tcphdr *th, int *tlenp, struct mbuf *m)
*/
te = uma_zalloc(V_tcp_reass_zone, M_NOWAIT);
if (te == NULL) {
if (th->th_seq != tp->rcv_nxt) {
if (th->th_seq != tp->rcv_nxt || !TCPS_HAVEESTABLISHED(tp->t_state)) {
TCPSTAT_INC(tcps_rcvmemdrop);
m_freem(m);
*tlenp = 0;
@ -276,7 +276,8 @@ tcp_reass(struct tcpcb *tp, struct tcphdr *th, int *tlenp, struct mbuf *m)
TCPSTAT_INC(tcps_rcvduppack);
TCPSTAT_ADD(tcps_rcvdupbyte, *tlenp);
m_freem(m);
uma_zfree(V_tcp_reass_zone, te);
if (te != &tqs)
uma_zfree(V_tcp_reass_zone, te);
tp->t_segqlen--;
/*
* Try to present any queued data

2
sys/sys/param.h
View File

@ -58,7 +58,7 @@
* in the range 5 to 9.
*/
#undef __FreeBSD_version
#define __FreeBSD_version 1000707 /* Master, propagated to newvers */
#define __FreeBSD_version 1000708 /* Master, propagated to newvers */
/*
* __FreeBSD_kernel__ indicates that this system uses the kernel of FreeBSD,