From: Armin Kuster <akuster808@gmail.com>
To: openembedded-core@lists.openembedded.org
Subject: [PATCH 04/20] openssh: CVE-2015-6563 CVE-2015-6564 CVE-2015-6565
Date: Sat, 9 Jan 2016 16:30:30 -0800 [thread overview]
Message-ID: <8a2034bffef3811ecff710b9a29dedeb52ed0f27.1452385571.git.akuster808@gmail.com> (raw)
In-Reply-To: <cover.1452385571.git.akuster808@gmail.com>
In-Reply-To: <cover.1452385571.git.akuster808@gmail.com>
From: Armin Kuster <akuster@mvista.com>
three security fixes.
CVE-2015-6563 (Low) openssh: Privilege separation weakness related to PAM support
CVE-2015-6564 (medium) openssh: Use-after-free bug related to PAM support
CVE-2015-6565 (High) openssh: Incorrectly set TTYs to be world-writable
(From OE-Core rev: 259df232b513367a0a18b17e3e377260a770288f)
Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster@mvista.com>
Conflicts:
meta/recipes-connectivity/openssh/openssh_6.6p1.bb
---
.../openssh/openssh/CVE-2015-6563.patch | 36 ++++++++++++++++++++++
.../openssh/openssh/CVE-2015-6564.patch | 34 ++++++++++++++++++++
.../openssh/openssh/CVE-2015-6565.patch | 35 +++++++++++++++++++++
meta/recipes-connectivity/openssh/openssh_6.6p1.bb | 5 ++-
4 files changed, 109 insertions(+), 1 deletion(-)
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2015-6563.patch
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2015-6564.patch
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2015-6565.patch
diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2015-6563.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2015-6563.patch
new file mode 100644
index 0000000..19cea41
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2015-6563.patch
@@ -0,0 +1,36 @@
+CVE-2015-6563
+
+Don't resend username to PAM; it already has it.
+Pointed out by Moritz Jodeit; ok dtucker@
+
+Upstream-Status: Backport
+https://github.com/openssh/openssh-portable/commit/d4697fe9a28dab7255c60433e4dd23cf7fce8a8b
+
+Signed-off-by: Armin Kuster <akuster@mvista.com>
+
+Index: openssh-6.7p1/monitor.c
+===================================================================
+--- openssh-6.7p1.orig/monitor.c
++++ openssh-6.7p1/monitor.c
+@@ -1046,9 +1046,7 @@ extern KbdintDevice sshpam_device;
+ int
+ mm_answer_pam_init_ctx(int sock, Buffer *m)
+ {
+-
+ debug3("%s", __func__);
+- authctxt->user = buffer_get_string(m, NULL);
+ sshpam_ctxt = (sshpam_device.init_ctx)(authctxt);
+ sshpam_authok = NULL;
+ buffer_clear(m);
+Index: openssh-6.7p1/monitor_wrap.c
+===================================================================
+--- openssh-6.7p1.orig/monitor_wrap.c
++++ openssh-6.7p1/monitor_wrap.c
+@@ -826,7 +826,6 @@ mm_sshpam_init_ctx(Authctxt *authctxt)
+
+ debug3("%s", __func__);
+ buffer_init(&m);
+- buffer_put_cstring(&m, authctxt->user);
+ mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PAM_INIT_CTX, &m);
+ debug3("%s: waiting for MONITOR_ANS_PAM_INIT_CTX", __func__);
+ mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_PAM_INIT_CTX, &m);
diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2015-6564.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2015-6564.patch
new file mode 100644
index 0000000..588d42d
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2015-6564.patch
@@ -0,0 +1,34 @@
+CVE-2015-6564
+
+ set sshpam_ctxt to NULL after free
+
+ Avoids use-after-free in monitor when privsep child is compromised.
+ Reported by Moritz Jodeit; ok dtucker@
+
+Upstream-Status: Backport
+https://github.com/openssh/openssh-portable/commit/5e75f5198769056089fb06c4d738ab0e5abc66f7
+
+Signed-off-by: Armin Kuster <akuster@mvista.com>
+
+Index: openssh-6.7p1/monitor.c
+===================================================================
+--- openssh-6.7p1.orig/monitor.c
++++ openssh-6.7p1/monitor.c
+@@ -1128,14 +1128,16 @@ mm_answer_pam_respond(int sock, Buffer *
+ int
+ mm_answer_pam_free_ctx(int sock, Buffer *m)
+ {
++ int r = sshpam_authok != NULL && sshpam_authok == sshpam_ctxt;
+
+ debug3("%s", __func__);
+ (sshpam_device.free_ctx)(sshpam_ctxt);
++ sshpam_ctxt = sshpam_authok = NULL;
+ buffer_clear(m);
+ mm_request_send(sock, MONITOR_ANS_PAM_FREE_CTX, m);
+ auth_method = "keyboard-interactive";
+ auth_submethod = "pam";
+- return (sshpam_authok == sshpam_ctxt);
++ return r;
+ }
+ #endif
+
diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2015-6565.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2015-6565.patch
new file mode 100644
index 0000000..42667b0
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2015-6565.patch
@@ -0,0 +1,35 @@
+CVE-2015-6565 openssh: Incorrectly set TTYs to be world-writable
+
+fix pty permissions; patch from Nikolay Edigaryev; ok deraadt
+
+Upstream-Status: Backport
+
+merged two changes into one.
+[1] https://anongit.mindrot.org/openssh.git/commit/sshpty.c?id=a5883d4eccb94b16c355987f58f86a7dee17a0c2
+tighten permissions on pty when the "tty" group does not exist; pointed out by Corinna Vinschen; ok markus
+
+[2] https://anongit.mindrot.org/openssh.git/commit/sshpty.c?id=6f941396b6835ad18018845f515b0c4fe20be21a
+fix pty permissions; patch from Nikolay Edigaryev; ok deraadt
+
+Signed-off-by: Armin Kuster <akuster@mvista.com>
+
+Index: openssh-6.7p1/sshpty.c
+===================================================================
+--- openssh-6.7p1.orig/sshpty.c
++++ openssh-6.7p1/sshpty.c
+@@ -196,13 +196,8 @@ pty_setowner(struct passwd *pw, const ch
+
+ /* Determine the group to make the owner of the tty. */
+ grp = getgrnam("tty");
+- if (grp) {
+- gid = grp->gr_gid;
+- mode = S_IRUSR | S_IWUSR | S_IWGRP;
+- } else {
+- gid = pw->pw_gid;
+- mode = S_IRUSR | S_IWUSR | S_IWGRP | S_IWOTH;
+- }
++ gid = (grp != NULL) ? grp->gr_gid : pw->pw_gid;
++ mode = (grp != NULL) ? 0620 : 0600;
+
+ /*
+ * Change owner and mode of the tty as required.
diff --git a/meta/recipes-connectivity/openssh/openssh_6.6p1.bb b/meta/recipes-connectivity/openssh/openssh_6.6p1.bb
index f575665..4b88704 100644
--- a/meta/recipes-connectivity/openssh/openssh_6.6p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_6.6p1.bb
@@ -25,7 +25,10 @@ SRC_URI = "ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar.
file://run-ptest \
file://openssh-CVE-2014-2532.patch \
file://openssh-CVE-2014-2653.patch \
- file://auth2-none.c-avoid-authenticate-empty-passwords-to-m.patch"
+ file://CVE-2015-6563.patch \
+ file://CVE-2015-6564.patch \
+ file://CVE-2015-6565.patch \
+ "
PAM_SRC_URI = "file://sshd"
--
1.9.1
next prev parent reply other threads:[~2016-01-10 0:31 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-01-10 0:30 [PATCH 00/20] Dizzy-next pull request 2016-1 Armin Kuster
2016-01-10 0:30 ` [PATCH 01/20] libtasn1: CVE-2015-3622 Armin Kuster
2016-01-10 0:30 ` [PATCH 02/20] grep2.19: CVE-2015-1345 Armin Kuster
2016-01-10 0:30 ` [PATCH 03/20] rsync: backport libattr checking patch Armin Kuster
2016-01-10 0:30 ` Armin Kuster [this message]
2016-01-10 0:30 ` [PATCH 05/20] fontcache: allow to pass extra parameters and environment to fc-cache Armin Kuster
2016-01-10 0:30 ` [PATCH 06/20] image.bbclass: don't let do_rootfs depend on BUILDNAME Armin Kuster
2016-01-10 0:30 ` [PATCH 07/20] layer.conf: Add several allarch dependency exclusions Armin Kuster
2016-01-10 0:30 ` [PATCH 08/20] layer.conf: Add missing dependency for allarch package initramfs-framework Armin Kuster
2016-01-10 0:30 ` [PATCH 09/20] allarch: Force TARGET_*FLAGS variable values Armin Kuster
2016-01-10 0:30 ` [PATCH 10/20] texinfo: don't create dependency on INHERIT variable Armin Kuster
2016-01-10 0:30 ` [PATCH 11/20] linux-dtb.inc: drop unused DTB_NAME variable from do_install Armin Kuster
2016-01-10 0:30 ` [PATCH 12/20] glibc: use patch for CVE-2015-1781 Armin Kuster
2016-01-10 0:30 ` [PATCH 13/20] libxml2: CVE-2015-7942 Armin Kuster
2016-01-10 0:30 ` [PATCH 14/20] unzip: CVE-2015-7696, CVE-2015-7697 Armin Kuster
2016-01-10 0:30 ` [PATCH 15/20] libxml2: CVE-2015-8035 Armin Kuster
2016-01-10 0:30 ` [PATCH 16/20] openssl: CVE-2015-3194, CVE-2015-3195 Armin Kuster
2016-01-10 0:30 ` [PATCH 17/20] libxml2: CVE-2015-8241 Armin Kuster
2016-01-10 0:30 ` [PATCH 18/20] Fixes a heap buffer overflow in glibc wscanf Armin Kuster
2016-01-10 0:30 ` [PATCH 19/20] grub2: Fix CVE-2015-8370 Armin Kuster
2016-01-10 0:30 ` [PATCH 20/20] bind: CVE-2015-8000 Armin Kuster
2016-01-21 11:57 ` [PATCH 00/20] Dizzy-next pull request 2016-1 Martin Jansa
2016-01-27 11:33 ` Martin Jansa
2016-01-30 2:44 ` akuster808
2016-01-30 9:08 ` Martin Jansa
2016-01-30 12:06 ` Richard Purdie
2016-01-30 12:37 ` Martin Jansa
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=8a2034bffef3811ecff710b9a29dedeb52ed0f27.1452385571.git.akuster808@gmail.com \
--to=akuster808@gmail.com \
--cc=openembedded-core@lists.openembedded.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox