From owner-svn-ports-all@freebsd.org Thu Mar 19 18:00:34 2020 Return-Path: Delivered-To: svn-ports-all@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id E50A426C7BE; Thu, 19 Mar 2020 18:00:34 +0000 (UTC) (envelope-from gordon@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 48jvpB567tz46Qx; Thu, 19 Mar 2020 18:00:34 +0000 (UTC) (envelope-from gordon@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id AA0F5ECBC; Thu, 19 Mar 2020 18:00:34 +0000 (UTC) (envelope-from gordon@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id 02JI0Y7P068000; Thu, 19 Mar 2020 18:00:34 GMT (envelope-from gordon@FreeBSD.org) Received: (from gordon@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id 02JI0YBX067999; Thu, 19 Mar 2020 18:00:34 GMT (envelope-from gordon@FreeBSD.org) Message-Id: <202003191800.02JI0YBX067999@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: gordon set sender to gordon@FreeBSD.org using -f From: Gordon Tetlow Date: Thu, 19 Mar 2020 18:00:34 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r528737 - head/security/vuxml X-SVN-Group: ports-head X-SVN-Commit-Author: gordon X-SVN-Commit-Paths: head/security/vuxml X-SVN-Commit-Revision: 528737 X-SVN-Commit-Repository: ports MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-all@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: SVN commit messages for the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 19 Mar 2020 18:00:35 -0000 Author: gordon (src committer) Date: Thu Mar 19 18:00:34 2020 New Revision: 528737 URL: https://svnweb.freebsd.org/changeset/ports/528737 Log: Add details for today's SAs. Approved by: so Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Thu Mar 19 17:56:40 2020 (r528736) +++ head/security/vuxml/vuln.xml Thu Mar 19 18:00:34 2020 (r528737) @@ -58,6 +58,158 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> + + FreeBSD -- Kernel memory disclosure with nested jails + + + FreeBSD-kernel + 12.112.1_3 + 11.311.3_7 + + + + +

Problem Description:

A missing NUL-termination check for the jail_set(2) configration + option "osrelease" may return more bytes when reading the jail + configuration back with jail_get(2) than were originally set.

Impact:

For jails with a non-default setting of children.max > 0 ("nested + jails") a superuser inside a jail can create a jail and may be able to + read and take advantage of exposed kernel memory.

+ + + + CVE-2020-7453 + SA-20:08.jail + + + 2020-03-19 + 2020-03-19 + + + + + FreeBSD -- Incorrect user-controlled pointer use in epair + + + FreeBSD-kernel + 12.112.1_3 + 11.311.3_7 + + + + +

Problem Description:

Incorrect use of a potentially user-controlled pointer in the kernel + allowed vnet jailed users to panic the system and potentially execute + aribitrary code in the kernel.

Impact:

Users with root level access (or the PRIV_NET_IFCREATE privilege) + can panic the system, or potentially escape the jail or execute + arbitrary code with kernel priviliges.

+ + + + CVE-2020-7452 + SA-20:07.epair + + + 2020-03-19 + 2020-03-19 + + + + + FreeBSD -- Insufficient ixl(4) ioctl(2) privilege checking + + + FreeBSD-kernel + 12.112.1_3 + + + + +

Problem Description:

The driver-specific ioctl(2) command handlers in ixl(4) failed to + check whether the caller has sufficient privileges to perform the + corresponding operation.

Impact:

The ixl(4) handler permits unprivileged users to trigger updates to + the device's non-volatile memory (NVM).

+ + + + CVE-2019-15877 + SA-20:06.if_ixl_ioctl + + + 2020-03-19 + 2020-03-19 + + + + + FreeBSD -- Insufficient oce(4) ioctl(2) privilege checking + + + FreeBSD-kernel + 12.112.1_3 + 11.311.3_7 + + + + +

Problem Description:

The driver-specific ioctl(2) command handlers in oce(4) failed to + check whether the caller has sufficient privileges to perform the + corresponding operation.

Impact:

The oce(4) handler permits unprivileged users to send passthrough + commands to device firmware.

+ + + + CVE-2019-15876 + SA-20:05.if_oce_ioctl + + + 2020-03-19 + 2020-03-19 + + + + + FreeBSD -- TCP IPv6 SYN cache kernel information disclosure + + + FreeBSD-kernel + 12.112.1_3 + 11.311.3_7 + + + + +

Problem Description:

When a TCP server transmits or retransmits a TCP SYN-ACK segment + over IPv6, the Traffic Class field is not initialized. This also + applies to challenge ACK segments, which are sent in response to + received RST segments during the TCP connection setup phase.

Impact:

For each TCP SYN-ACK (or challenge TCP-ACK) segment sent over IPv6, + one byte of kernel memory is transmitted over the network.

+ + + + CVE-2020-7451 + SA-20:04.tcp + + + 2020-03-19 + 2020-03-19 + + + www/py-bleach -- multiple vulnerabilities @@ -489,7 +641,6 @@ compromised.

FreeBSD 11.311.3_7 - 12.012.0_14 12.112.1_3 @@ -503,7 +654,7 @@ compromised.

nwtine.org reports:

nwtime.org reports:

Three ntp vulnerabilities, Depending on configuration, may have little impact up to termination of the ntpd process.
@@ -531,7 +682,7 @@ compromised.
- INSERT BLOCKQUOTE URL HERE + SA-20:09.ntp 2019-05-30