From owner-freebsd-security@freebsd.org Sun Jan 31 17:35:46 2021 Return-Path: Delivered-To: freebsd-security@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 116824FDED6 for ; Sun, 31 Jan 2021 17:35:46 +0000 (UTC) (envelope-from gordon@tetlows.org) Received: from mail-pf1-x42a.google.com (mail-pf1-x42a.google.com [IPv6:2607:f8b0:4864:20::42a]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "smtp.gmail.com", Issuer "GTS CA 1O1" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4DTJBn1Qc0z3sC8 for ; Sun, 31 Jan 2021 17:35:45 +0000 (UTC) (envelope-from gordon@tetlows.org) Received: by mail-pf1-x42a.google.com with SMTP id q20so10011270pfu.8 for ; Sun, 31 Jan 2021 09:35:44 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=tU7mzm/Jnzss1Vu5h67sc+Y20pyVb9uASE14XviCRQU=; b=Fn4B3wGVDrd8BvJsOBqiwmGsmdd8Wt6xpjQTY564pPmGpuEK5spW4FCS8depAyiVi2 0npaetSEhHe28Tr9V1w+47BynCrgmMuChe6RShjyhtx869KLGyrkvj7Y4lfe74O+fTgP 3DNM+zgzxYdqIf0K+22bgZuzzbWmrsnmxTSvqPfLdehhErSgWe9u577RxWgrLlx6l4WR cz4owmUo5k6ucJEZLDY2ewcxnybHFAjDg6dS4pVfSbWwUyBHUQKoMEmMcgk+kC1hSygc 7T6453dWWARmq6fQW08sHiZpExDAI9LiBCkHLUlsFx8ZWwPU0AC7gzF+/teg1gr85G8E Xahg== X-Gm-Message-State: AOAM532vfJ2S2ykDfFG+T9odyy9fja7wkMIGHk+XSFZa7m1jFWWvHVlY EeWor8DJxEc1b/3eKVK8nu06VDZYZDDrJME= X-Google-Smtp-Source: ABdhPJwumqCm2BtVaiVoQVEIcG0xbJa5S0I+xvMcg8gIuuAnUuaZYAQ7zyih2eKZlgwqsCA6kpDXlw== X-Received: by 2002:a65:6409:: with SMTP id a9mr13308390pgv.212.1612114543705; Sun, 31 Jan 2021 09:35:43 -0800 (PST) Received: from 2603-8001-5e40-d300-d13a-46c6-7601-6917.res6.spectrum.com (2603-8001-5e40-d300-d13a-46c6-7601-6917.res6.spectrum.com. [2603:8001:5e40:d300:d13a:46c6:7601:6917]) by smtp.gmail.com with ESMTPSA id gd11sm13487463pjb.16.2021.01.31.09.35.41 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Sun, 31 Jan 2021 09:35:42 -0800 (PST) From: Gordon Tetlow Message-Id: <6260D94B-3CC6-48CB-AA5A-7438D1E39679@tetlows.org> Content-Type: multipart/signed; boundary="Apple-Mail=_6812AF18-FDEF-4873-84B1-591B10CB40AE"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 14.0 \(3654.40.0.2.32\)) Subject: Re: [FreeBSD-Announce] FreeBSD Security Advisory FreeBSD-SA-21:01.fsdisclosure Date: Sun, 31 Jan 2021 09:35:31 -0800 In-Reply-To: <15879d07-6563-f762-c93c-cf91c9516ce7@netfence.it> Cc: freebsd-security@freebsd.org To: Andrea Venturoli References: <20210129022826.C82C91DB44@freefall.freebsd.org> <15879d07-6563-f762-c93c-cf91c9516ce7@netfence.it> X-Mailer: Apple Mail (2.3654.40.0.2.32) X-Rspamd-Queue-Id: 4DTJBn1Qc0z3sC8 X-Spamd-Bar: ----- X-Spamd-Result: default: False [-5.60 / 15.00]; RCVD_VIA_SMTP_AUTH(0.00)[]; TO_DN_SOME(0.00)[]; MV_CASE(0.50)[]; R_SPF_ALLOW(-0.20)[+ip6:2607:f8b0:4000::/36]; HAS_ATTACHMENT(0.00)[]; RCVD_COUNT_THREE(0.00)[3]; DKIM_TRACE(0.00)[tetlows.org:+]; RCPT_COUNT_TWO(0.00)[2]; DMARC_POLICY_ALLOW(-0.50)[tetlows.org,quarantine]; NEURAL_HAM_SHORT(-1.00)[-1.000]; SIGNED_PGP(-2.00)[]; FROM_EQ_ENVFROM(0.00)[]; MIME_TRACE(0.00)[0:+,1:+,2:~]; RBL_DBL_DONT_QUERY_IPS(0.00)[2607:f8b0:4864:20::42a:from]; ASN(0.00)[asn:15169, ipnet:2607:f8b0::/32, country:US]; MID_RHS_MATCH_FROM(0.00)[]; ARC_NA(0.00)[]; NEURAL_HAM_MEDIUM(-1.00)[-1.000]; R_DKIM_ALLOW(-0.20)[tetlows.org:s=google]; FREEFALL_USER(0.00)[gordon]; FROM_HAS_DN(0.00)[]; NEURAL_HAM_LONG(-1.00)[-1.000]; MIME_GOOD(-0.20)[multipart/signed,text/plain]; PREVIOUSLY_DELIVERED(0.00)[freebsd-security@freebsd.org]; SPAMHAUS_ZRD(0.00)[2607:f8b0:4864:20::42a:from:127.0.2.255]; TO_MATCH_ENVRCPT_SOME(0.00)[]; RCVD_IN_DNSWL_NONE(0.00)[2607:f8b0:4864:20::42a:from]; RCVD_TLS_ALL(0.00)[]; MAILMAN_DEST(0.00)[freebsd-security] X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 31 Jan 2021 17:35:46 -0000 --Apple-Mail=_6812AF18-FDEF-4873-84B1-591B10CB40AE Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii > On Jan 31, 2021, at 7:25 AM, Andrea Venturoli wrote: >=20 > On 1/31/21 12:29 PM, Miroslav Lachman wrote: >=20 >>> Several file systems were not properly initializing the d_off field = of >>> the dirent structures returned by VOP_READDIR. In particular, = tmpfs(5), >>> smbfs(5), autofs(5) and mqueuefs(5) were failing to do so. As a = result, >>> eight uninitialized kernel stack bytes may be leaked to userspace by >>> these file systems. This problem is not present in FreeBSD 11. >> There is a Corrected in: stable/11, 11.4-STABLE and releng/11.4, = 11.4-RELEASE-p7, but later is a statement "This problem is not present = in FreeBSD 11". >> What is true? Is it fixed in newer patchlevel of FreeBSD 11.4 or it = was not present in 11.x at all? >=20 > My understanding is that the problem described in that paragraph does = not affect 11.x, but the next one does (and is "Corrected..."). >=20 > I.e. 11.x is affected by: >=20 >> Additionally, msdosfs(5) was failing to zero-fill a pair of padding >> fields in the dirent structure, resulting in a leak of three >> uninitialized bytes. >=20 >=20 > Is that right? This is correct. If you look at the patch cited for 11.x, it only has a = fix applied to msdosfs(5). Best regards, Gordon --Apple-Mail=_6812AF18-FDEF-4873-84B1-591B10CB40AE Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEuyjUCzYO7pNq7RVv5fe8y6O93fgFAmAW6mMACgkQ5fe8y6O9 3fj9KwgAgaYtWdyqtjQSJsruj6TekcEqwS3nBOUcwrGB0dPOa4SnDgXoqBilx2Xc rl8iQ6dzasorsBreAyGiRkIEDXjGWqZmcqHYtsoUlRtWcGC6KdY6VIfM8xpJfrsA oHzOyaAgIsFsDfjCPFduPD5Y8zE5oYNth2C8bJv3mJ5+TtpzRMbEYGDY79juWhxz 8du0+9hA8y7skOfojRj6FVa03Ut1i7IdCPPs5pKvQHa45x5l+Fo/irnK8jIbV8LJ zGAqWLc4qgMQdPWFW1eM+1P0AGpCm8Qea79xNCKUubJfCPJmptZyU8rLFK+TDcan Qv6PkgJm8Kq3wLcBjlu2cTrDT/4jfw== =4yBm -----END PGP SIGNATURE----- --Apple-Mail=_6812AF18-FDEF-4873-84B1-591B10CB40AE--