Date: Wed, 5 Aug 2020 17:30:27 +0000 (UTC) From: Gordon Tetlow <gordon@FreeBSD.org> To: doc-committers@freebsd.org, svn-doc-all@freebsd.org, svn-doc-head@freebsd.org Subject: svn commit: r54399 - in head/share: security/advisories security/patches/EN-20:16 security/patches/SA-20:21 security/patches/SA-20:22 security/patches/SA-20:23 xml Message-ID: <202008051730.075HURbY007286@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: gordon (src committer) Date: Wed Aug 5 17:30:26 2020 New Revision: 54399 URL: https://svnweb.freebsd.org/changeset/doc/54399 Log: Add EN-20:16 and SA-20:21 through SA-20:23. Approved by: so Added: head/share/security/advisories/FreeBSD-EN-20:16.vmx.asc (contents, props changed) head/share/security/advisories/FreeBSD-SA-20:21.usb_net.asc (contents, props changed) head/share/security/advisories/FreeBSD-SA-20:22.sqlite.asc (contents, props changed) head/share/security/advisories/FreeBSD-SA-20:23.sendmsg.asc (contents, props changed) head/share/security/patches/EN-20:16/ head/share/security/patches/EN-20:16/vmx.patch (contents, props changed) head/share/security/patches/EN-20:16/vmx.patch.asc (contents, props changed) head/share/security/patches/SA-20:21/ head/share/security/patches/SA-20:21/usb_net.11.patch (contents, props changed) head/share/security/patches/SA-20:21/usb_net.11.patch.asc (contents, props changed) head/share/security/patches/SA-20:21/usb_net.12.patch (contents, props changed) head/share/security/patches/SA-20:21/usb_net.12.patch.asc (contents, props changed) head/share/security/patches/SA-20:22/ head/share/security/patches/SA-20:22/sqlite.11.3.patch (contents, props changed) head/share/security/patches/SA-20:22/sqlite.11.3.patch.asc (contents, props changed) head/share/security/patches/SA-20:22/sqlite.11.4.patch (contents, props changed) head/share/security/patches/SA-20:22/sqlite.11.4.patch.asc (contents, props changed) head/share/security/patches/SA-20:22/sqlite.12.1.patch (contents, props changed) head/share/security/patches/SA-20:22/sqlite.12.1.patch.asc (contents, props changed) head/share/security/patches/SA-20:23/ head/share/security/patches/SA-20:23/sendmsg.patch (contents, props changed) head/share/security/patches/SA-20:23/sendmsg.patch.asc (contents, props changed) Modified: head/share/xml/advisories.xml head/share/xml/notices.xml Added: head/share/security/advisories/FreeBSD-EN-20:16.vmx.asc ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/share/security/advisories/FreeBSD-EN-20:16.vmx.asc Wed Aug 5 17:30:26 2020 (r54399) @@ -0,0 +1,126 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +============================================================================= +FreeBSD-EN-20:16.vmx Errata Notice + The FreeBSD Project + +Topic: vmx driver packet loss and degraded performance + +Category: core +Module: vmx +Announced: 2020-08-05 +Affects: FreeBSD 12.1 +Corrected: 2020-01-20 22:15:33 UTC (stable/12, 12.1-STABLE) + 2020-08-05 17:09:54 UTC (releng/12.1, 12.1-RELEASE-p8) + +For general information regarding FreeBSD Errata Notices and Security +Advisories, including descriptions of the fields above, security +branches, and the following sections, please visit +<URL:https://security.FreeBSD.org/>. + +I. Background + +vmx(4) is a driver for the virtualized network interface device used by +VMware. It implements TCP segmentation offload (TSO), a performance +feature which allows the device to perform TCP segmentation immediately +prior to packet transmission, reducing the amount of work required of +the kernel's TCP implementation. + +II. Problem Description + +vmx(4) in FreeBSD 12.1 contains a bug which causes the driver to set up +transmit descriptors incorrectly when performing TSO. + +III. Impact + +With TSO enabled in vmx(4) interfaces, TCP sessions may hang or +experience degraded performance due to packet loss. + +IV. Workaround + +Using ifconfig(8), TSO can be disabled on vmx(4) interfaces by +specifying "-tso". + +V. Solution + +Upgrade your system to a supported FreeBSD stable or release / security +branch (releng) dated after the correction date and reboot. + +Perform one of the following: + +1) To update your system via a binary patch: + +Systems running a RELEASE version of FreeBSD on the i386 or amd64 +platforms can be updated via the freebsd-update(8) utility: + +# freebsd-update fetch +# freebsd-update install +# shutdown -r +10min "Rebooting for errata update" + +2) To update your system via a source code patch: + +The following patches have been verified to apply to the applicable +FreeBSD release branches. + +a) Download the relevant patch from the location below, and verify the +detached PGP signature using your PGP utility. + +# fetch https://security.FreeBSD.org/patches/EN-20:16/vmx.patch +# fetch https://security.FreeBSD.org/patches/EN-20:16/vmx.patch.asc +# gpg --verify vmx.patch.asc + +b) Apply the patch. Execute the following commands as root: + +# cd /usr/src +# patch < /path/to/patch + +c) Recompile your kernel as described in +<URL:https://www.FreeBSD.org/handbook/kernelconfig.html>; and reboot the +system. + +VI. Correction details + +The following list contains the correction revision numbers for each +affected branch. + +Branch/path Revision +- ------------------------------------------------------------------------- +stable/12/ r356932 +releng/12.1/ r363920 +- ------------------------------------------------------------------------- + +To see which files were modified by a particular revision, run the +following command, replacing NNNNNN with the revision number, on a +machine with Subversion installed: + +# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base + +Or visit the following URL, replacing NNNNNN with the revision number: + +<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>; + +VII. References + +<URL:https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=236999>; + +The latest revision of this advisory is available at +<URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-20:16.vmx.asc>; +-----BEGIN PGP SIGNATURE----- + +iQKTBAEBCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAl8q63ZfFIAAAAAALgAo +aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD +MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n +5cIe2xAAoGWYRnKtTDRNBwKZSXbXSSrNcNv7rsiPGIqHYjn78ZBRypWFlztLzW8G +eAfo7ffcXDN6PfVrhg2ADKBHfOmghOWHvSEoigV8aT9fgBBvBoFoElmvUdLQjn6o +y5ABUoMbwapXSNDQtGEFi5wtBfomcfpZzxVRNTNzzbPCO3gkG3WZ4/0wiS9TXV34 +SMU2xLIeo0qvBGUfHpqTz+6BfCP/rtMCZ2kx6dIVYguGqBkRxkvJA4q4omEeokWz +XDyE32MdosB8DlmozhL+VDCFAB4k328nbO4kY3czdqOmOQ9krDdB176fHfT/+3Zm +6ogK2JvNNY9vZSeB3sqwSkv4j6B8aSb21bEDTopxF93TwsPO9hkIFC1f1ASH0YYP +TtPli/lsTGy1UdhuURNjgK6c5IuWkgeZpuJdX3UDyxDv+TDk8FvlAyR0R9EPsL3t +MoGKy12dsSF+Nkn6K9hmY9nRRpF6dlgHDpWsGQvJ8j8aw2QciVTU60vE47oM47js +v8KIOliq+OzaPWnL420wR0rjXJo3HIQmdyF1sVpLcFRW26QdJ+0No22qB4BLNr9D +zExolxEAlL/6jsrSwBoZdiHGxzxjFUPJBJojARIP2tZSLRlhGFmNJVnzAoPE5KY5 +HuxyDRcLqY0Rmeycs3pdupYd6ze2ViNbJsry7XY9+zbW15e1qNw= +=/2NI +-----END PGP SIGNATURE----- Added: head/share/security/advisories/FreeBSD-SA-20:21.usb_net.asc ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/share/security/advisories/FreeBSD-SA-20:21.usb_net.asc Wed Aug 5 17:30:26 2020 (r54399) @@ -0,0 +1,147 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +============================================================================= +FreeBSD-SA-20:21.usb_net Security Advisory + The FreeBSD Project + +Topic: Potential memory corruption in USB network device drivers + +Category: core +Module: kernel +Announced: 2020-08-05 +Credits: Ilja van Sprundel, IOActive +Affects: All supported versions of FreeBSD. +Corrected: 2020-06-14 05:25:06 UTC (stable/12, 12.1-STABLE) + 2020-08-05 17:11:18 UTC (releng/12.1, 12.1-RELEASE-p8) + 2020-06-14 05:27:37 UTC (stable/11, 11.4-STABLE) + 2020-08-05 17:11:18 UTC (releng/11.4, 11.4-RELEASE-p2) + 2020-08-05 17:11:18 UTC (releng/11.3, 11.3-RELEASE-p12) +CVE Name: CVE-2020-7459 + +For general information regarding FreeBSD Security Advisories, +including descriptions of the fields above, security branches, and the +following sections, please visit <URL:https://security.FreeBSD.org/>. + +I. Background + +FreeBSD includes a number of USB Ethernet network interface device drivers, +including: + + - smsc(4), supporting SMSC (now Microchip) devices + - muge(4), supporting Microchip devices + - cdceem(4), supporting USB Communication Device Class compatible devices + +II. Problem Description + +A missing length validation code common to these three drivers means that a +malicious USB device could write beyond the end of an allocated network +packet buffer. + +III. Impact + +An attacker with physical access to a USB port and the ability to bring a +network interface up may be able to use a specially crafted USB device to +gain kernel or user-space code execution. + +IV. Workaround + +No workaround is available. Systems with no active (i.e., UP) interface +supported by any of the smsc(4), muge(4), and cdceem(4) drivers are not +vulnerable. + +Exploitation likely requires malicious USB hardware that emulates hardware +supported by one of these device drivers. + +V. Solution + +Upgrade your vulnerable system to a supported FreeBSD stable or +release / security branch (releng) dated after the correction date, +and reboot. + +Perform one of the following: + +1) To update your vulnerable system via a binary patch: + +Systems running a RELEASE version of FreeBSD on the i386 or amd64 +platforms can be updated via the freebsd-update(8) utility: + +# freebsd-update fetch +# freebsd-update install +# shutdown -r +10min "Rebooting for a security update" + +2) To update your vulnerable system via a source code patch: + +The following patches have been verified to apply to the applicable +FreeBSD release branches. + +a) Download the relevant patch from the location below, and verify the +detached PGP signature using your PGP utility. + +[FreeBSD 12.x] +# fetch https://security.FreeBSD.org/patches/SA-20:21/usb_net.12.patch +# fetch https://security.FreeBSD.org/patches/SA-20:21/usb_net.12.patch.asc +# gpg --verify usb_net.12.patch.asc + +[FreeBSD 11.x] +# fetch https://security.FreeBSD.org/patches/SA-20:21/usb_net.11.patch +# fetch https://security.FreeBSD.org/patches/SA-20:21/usb_net.11.patch.asc +# gpg --verify usb_net.11.patch.asc + +b) Apply the patch. Execute the following commands as root: + +# cd /usr/src +# patch < /path/to/patch + +c) Recompile your kernel as described in +<URL:https://www.FreeBSD.org/handbook/kernelconfig.html>; and reboot the +system. + +VI. Correction details + +The following list contains the correction revision numbers for each +affected branch. + +Branch/path Revision +- ------------------------------------------------------------------------- +stable/12/ r362166 +releng/12.1/ r363921 +stable/11/ r362167 +releng/11.4/ r363921 +releng/11.3/ r363921 +- ------------------------------------------------------------------------- + +To see which files were modified by a particular revision, run the +following command, replacing NNNNNN with the revision number, on a +machine with Subversion installed: + +# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base + +Or visit the following URL, replacing NNNNNN with the revision number: + +<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>; + +VII. References + +<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7459>; + +The latest revision of this advisory is available at +<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-20:21.usb_net.asc>; +-----BEGIN PGP SIGNATURE----- + +iQKTBAEBCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAl8q63dfFIAAAAAALgAo +aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD +MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n +5cIp7g//ZGKbxNKWsYEFXwNbBVbtkWMCQbj0V0TG2NReOsbYYhOolfkErZBpeTHt +iFJr5m3WY21a6ks/8up02HJyZ5oZwFFeMOMF/CKibZuym/8L8XgoU0uh/eHLiTvZ +qRf3p43xegcKgatFPggKA0yewNxMNETHI7BeO6+pkwYFQgb7f9GhM4JzC+DmaX6i +kyGcrnYoZzgKo2BGt65VRbvzucw/Su7wL4JutKhZlXDz7kxFv1gxB8Dqk9BBW9QM +EHejzhMCo6T0doYKLuZnz+SI2a/LOcTuNgR+5RnnxsVziLx+8csMNYy3YVw6JNXe +XC+8aJ7Un8BLKDoNJjoZ/J9IygJoaWgUa9+SH0pAtOeWhrfRUgd74ZZWfhiZkK5U +AXgY46c6Ce28TbEHTWgOAQgXRNB7iJgxVo6mTSnDt8t3YWh4t3g/rjHPKHagTNYC +aCd6gcJewb1Pw/8X/7H1FXRtUleHgMaxQ7ec8V5BwcXSexo4xZfq8qQTUbCuRmDg +4GaF8SondVb1TJxHwfq2wWvFhiwMWnRxwwjY6jkxiIjecc5vtrb2bwRq7nmKWciT +uV0jRj9ttP73ftE/zO94avXCbpCfHXMSpwaJMcs8PH+sHYXNhy0awuIped1ANXlh +E2jrNBW85gyKpnjfcAgECFid3Cu1V1xWo1BCTOWJXQjKi2Gaoa0= +=xbKP +-----END PGP SIGNATURE----- Added: head/share/security/advisories/FreeBSD-SA-20:22.sqlite.asc ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/share/security/advisories/FreeBSD-SA-20:22.sqlite.asc Wed Aug 5 17:30:26 2020 (r54399) @@ -0,0 +1,159 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +============================================================================= +FreeBSD-SA-20:22.sqlite Security Advisory + The FreeBSD Project + +Topic: Multiple vulnerabilities in sqlite3 + +Category: contrib +Module: sqlite3 +Announced: 2020-08-05 +Affects: All supported versions of FreeBSD. +Corrected: 2020-06-15 03:10:53 UTC (stable/12, 12.1-STABLE) + 2020-08-05 17:13:08 UTC (releng/12.1, 12.1-RELEASE-p8) + 2020-06-15 03:10:53 UTC (stable/11, 11.4-STABLE) + 2020-08-05 17:13:08 UTC (releng/11.4, 11.4-RELEASE-p2) + 2020-08-05 17:13:08 UTC (releng/11.3, 11.3-RELEASE-p12) +CVE Name: CVE-2020-11655, CVE-2020-11656, CVE-2020-13434, + CVE-2020-13435, CVE-2020-13630, CVE-2020-13631, + CVE-2020-13632 + +For general information regarding FreeBSD Security Advisories, +including descriptions of the fields above, security branches, and the +following sections, please visit <URL:https://security.FreeBSD.org/>. + +I. Background + +SQLite is an SQL database engine in a C library. Programs that link the +SQLite library can have SQL database access without running a separate RDBMS +process. The distribution comes with a standalone command-line access +program (sqlite3) that can be used to administer an SQLite database and which +serves as an example of how to use the SQLite library. + +FreeBSD includes SQLite as a private library for base system usage that is +not generally exposed for third party packages to use. + +II. Problem Description + +Multiple vulnerabilities have been published including improper input +validation (CVE-2020-11655), use after free (CVE-2020-11656, CVE-2020-13630), +integer overflow (CVE-2020-13434), null pointer dereference (CVE-2020-13435, +CVE-2020-13632), and namespace collision (CVE-2020-13631). + +III. Impact + +Malicious SQL statements could crash, hijack processes, or cause data +corruption. + +IV. Workaround + +No workaround is available. The FreeBSD security team is not aware of any +base system components that use SQLite in such a way as to expose these +vulnerabilities to untrusted or remote users, but is updating SQLite out of +an abundance of caution. + +V. Solution + +Upgrade your vulnerable system to a supported FreeBSD stable or +release / security branch (releng) dated after the correction date. + +Perform one of the following: + +1) To update your vulnerable system via a binary patch: + +Systems running a RELEASE version of FreeBSD on the i386 or amd64 +platforms can be updated via the freebsd-update(8) utility: + +# freebsd-update fetch +# freebsd-update install +# shutdown -r +10min "Rebooting for a security update" + +2) To update your vulnerable system via a source code patch: + +The following patches have been verified to apply to the applicable +FreeBSD release branches. + +a) Download the relevant patch from the location below, and verify the +detached PGP signature using your PGP utility. + +[FreeBSD 12.1] +# fetch https://security.FreeBSD.org/patches/SA-20:21/sqlite.12.1.patch +# fetch https://security.FreeBSD.org/patches/SA-20:21/sqlite.12.1.patch.asc +# gpg --verify sqlite.12.1.patch.asc + +[FreeBSD 11.4] +# fetch https://security.FreeBSD.org/patches/SA-20:21/sqlite.11.4.patch +# fetch https://security.FreeBSD.org/patches/SA-20:21/sqlite.11.4.patch.asc +# gpg --verify sqlite.11.4.patch.asc + +[FreeBSD 11.3] +# fetch https://security.FreeBSD.org/patches/SA-20:21/sqlite.11.3.patch +# fetch https://security.FreeBSD.org/patches/SA-20:21/sqlite.11.3.patch.asc +# gpg --verify sqlite.11.3.patch.asc + +b) Apply the patch. Execute the following commands as root: + +# cd /usr/src +# patch < /path/to/patch + +c) Recompile the operating system using buildworld and installworld as +described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>. + +Restart all daemons that use the library, or reboot the system. + +VI. Correction details + +The following list contains the correction revision numbers for each +affected branch. + +Branch/path Revision +- ------------------------------------------------------------------------- +stable/12/ r362190 +releng/12.1/ r363922 +stable/11/ r362190 +releng/11.4/ r363922 +releng/11.3/ r363922 +- ------------------------------------------------------------------------- + +To see which files were modified by a particular revision, run the +following command, replacing NNNNNN with the revision number, on a +machine with Subversion installed: + +# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base + +Or visit the following URL, replacing NNNNNN with the revision number: + +<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>; + +VII. References + +<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11655>; +<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11656>; +<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13434>; +<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13435>; +<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13630>; +<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13631>; +<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13632>; + +The latest revision of this advisory is available at +<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-20:21.sqlite.asc>; +-----BEGIN PGP SIGNATURE----- + +iQKTBAEBCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAl8q63dfFIAAAAAALgAo +aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD +MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n +5cIJdw/9FSXst26ZsA63KixpJbWMnlzJkSPEPiGQ0SlrfeE7co6qukiAnxKzL9rW +P5ztBbqqcqu/mISIDDRaOp03ex1oAwhYf4cMRCX4v1wZmGfdH6L9s0LwgfFXtT2G +RwucImiAKHwLo7YTxUs54qrSu6gmDUp9u440ac1tVHSEsKzvD557sg4sp248tSZx ++/W667F2xsed4plRvNostfFD1aIbBsgMl0vz4FPZ3dToxrjpeSW+9aHrv6iIgsSA +jheXF/Fol5AABrHrOHc8HbKBsDEsmz/AdwHiX1ngH1dXRRze95YEJy64Ee0C7/Fj +MXlhg3JqctCFXy2e2nTHna5xKd3YW4Gy2b2xquIAg/W9rZRxy1ZwQEOO5R+DyteF +s/YN6oD4jJPsR2uTUMq4Z6q7IKDwb7PT2ncTblxIG7vBs6V6NuM0Yd0cqMdPnEdt +rn7hIaPvvsp3nFYMPhIX9gMRl5K9Vl11BWtfEFv3Egh5c5jA0/LWvMP1DLkpKV8c +lXP5C/cltod7zTAkCk8XxOOCi5fLnP8qPQhAy3etq2dtREMgkHfnIxPSmjqsPgBI +uU4CXW3dDlh9RrsePwls++BItUcueKDUJYBAS98Z+XLxaapjj4R3fYa2ygbyjqno +nprfR9X6QW6MPv0xL9wCTGqwQXrvWxDxlnTPEQ5Ah6eOCKEfWD8= +=nB/p +-----END PGP SIGNATURE----- Added: head/share/security/advisories/FreeBSD-SA-20:23.sendmsg.asc ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/share/security/advisories/FreeBSD-SA-20:23.sendmsg.asc Wed Aug 5 17:30:26 2020 (r54399) @@ -0,0 +1,146 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +============================================================================= +FreeBSD-SA-20:23.sendmsg Security Advisory + The FreeBSD Project + +Topic: sendmsg(2) privilege escalation + +Category: core +Module: kernel compat32 +Announced: 2020-08-05 +Credits: m00nbsd working with Trend Micro Zero Day Initiative +Affects: All supported versions of FreeBSD. +Corrected: 2020-08-05 17:07:13 UTC (stable/12, 12.1-STABLE) + 2020-08-05 17:14:01 UTC (releng/12.1, 12.1-RELEASE-p8) + 2020-08-05 17:08:02 UTC (stable/11, 11.4-STABLE) + 2020-08-05 17:14:01 UTC (releng/11.4, 11.4-RELEASE-p2) + 2020-08-05 17:14:01 UTC (releng/11.3, 11.3-RELEASE-p12) +CVE Name: CVE-2020-7460 + +For general information regarding FreeBSD Security Advisories, +including descriptions of the fields above, security branches, and the +following sections, please visit <URL:https://security.FreeBSD.org/>. + +I. Background + +FreeBSD provides the compat32 subsystem, used to enable execution of 32-bit +binaries on amd64 and other 64-bit platforms. System calls whose parameters +require translation are handled by compat32 before being dispatched to the +native system call handler. + +sendmsg(2) and recvmsg(2) may be used to transmit or receive control messages +whose contents are evaluated by the kernel. Such messages have different +alignment constraints on 32-bit and 64-bit platforms and thus must be translated +by the compat32 subsystem when sendmsg(2) or recvmsg(2) are invoked by a 32-bit +process. + +II. Problem Description + +When handling a 32-bit sendmsg(2) call, the compat32 subsystem copies the +control message to be transmitted (if any) into kernel memory, and adjusts +alignment of control message headers. The code which performs this work +contained a time-of-check to time-of-use (TOCTOU) vulnerability which allows a +malicious userspace program to modify control message headers after they were +validated by the kernel. + +III. Impact + +The TOCTOU bug can be exploited by an unprivileged malicious userspace program +to trigger privilege escalation. + +IV. Workaround + +i386 and other 32-bit platforms are not vulnerable. + +No workaround is available for amd64 or arm64. Kernels compiled without the +COMPAT_FREEBSD32 option are not vulnerable, but this option is configured in +GENERIC kernels. + +V. Solution + +Upgrade your vulnerable system to a supported FreeBSD stable or +release / security branch (releng) dated after the correction date, +and reboot. + +Perform one of the following: + +1) To update your vulnerable system via a binary patch: + +Systems running a RELEASE version of FreeBSD on the i386 or amd64 +platforms can be updated via the freebsd-update(8) utility: + +# freebsd-update fetch +# freebsd-update install +# shutdown -r +10min "Rebooting for a security update" + +2) To update your vulnerable system via a source code patch: + +The following patches have been verified to apply to the applicable +FreeBSD release branches. + +a) Download the relevant patch from the location below, and verify the +detached PGP signature using your PGP utility. + +# fetch https://security.FreeBSD.org/patches/SA-20:23/sendmsg.patch +# fetch https://security.FreeBSD.org/patches/SA-20:23/sendmsg.patch.asc +# gpg --verify sendmsg.patch.asc + +b) Apply the patch. Execute the following commands as root: + +# cd /usr/src +# patch < /path/to/patch + +c) Recompile your kernel as described in +<URL:https://www.FreeBSD.org/handbook/kernelconfig.html>; and reboot the +system. + +VI. Correction details + +The following list contains the correction revision numbers for each +affected branch. + +Branch/path Revision +- ------------------------------------------------------------------------- +stable/12/ r363918 +releng/12.1/ r363923 +stable/11/ r363919 +releng/11.4/ r363923 +releng/11.3/ r363923 +- ------------------------------------------------------------------------- + +To see which files were modified by a particular revision, run the +following command, replacing NNNNNN with the revision number, on a +machine with Subversion installed: + +# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base + +Or visit the following URL, replacing NNNNNN with the revision number: + +<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>; + +VII. References + +<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7460>; + +The latest revision of this advisory is available at +<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-20:23.sendmsg.asc>; +-----BEGIN PGP SIGNATURE----- + +iQKTBAEBCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAl8q63hfFIAAAAAALgAo +aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD +MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n +5cJDxw/+PML4MB46paBDyLvebprXe5Z/FrUN1ybH8YjrJTYFyX+aw8K3hAa2K+PB +kUc3VwbIv0BAylSCgULXdTxx8JKpMnmHcN3Bk8LKdMCvp0gJvkzcAP/a7Kj1EKfY +m04p3/7ka9f7u99n1QX1jnZP2XWEFKOoyWbEJWuDk0+NBW3ICQWqQLoiXaWAS4HD +BrXAqowtyoR1vaMrAjmSyWaFSDFjQeiHw8nxCzRF1E6cKF/rwCt37cnpEGqSCAYi +/ZyB1qy1s67F9hHnZp9+JhffWqUZAuLse8HTWgBG+svpzDrx2gNxE/C/Tui0lYXg +S3akC3DbiySZpP007J8yR5PvytYAbSuECJVVRoC0dukmBabFqSFlacInpfIn363m +fOg1nmq/oRh9MAJzaBKG+N6SD+mP3kvcV9Ad5fOKr4yLQtlwYEYyiN1WbCs0O/ve +fnRIGB9xtibIr1i9IEY7+KNMAH3Di2F0E4ixFPMrBcJiStuZmCTqJRx99QLYtb0G +p9p1bzjPUaWAMDi9mteFu1I+NO836MeLydbCZnSa5KLe+vc1PjP4kSvt6XQ9HFtO +nXMddWxdcus8BmxZ04K5a4WaaSYOiN4e4O72WWuA714io+EWJAEaqleMr7KbYTCv +f1fCmoKxyoFJcHL9z3oOOi5DqrBoFPnE0p/gPGFc8qyTNEbI428= +=tTSr +-----END PGP SIGNATURE----- Added: head/share/security/patches/EN-20:16/vmx.patch ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/share/security/patches/EN-20:16/vmx.patch Wed Aug 5 17:30:26 2020 (r54399) @@ -0,0 +1,11 @@ +--- sys/dev/vmware/vmxnet3/if_vmx.c.orig ++++ sys/dev/vmware/vmxnet3/if_vmx.c +@@ -1320,7 +1320,7 @@ + hdrlen = pi->ipi_ehdrlen + pi->ipi_ip_hlen; + if (pi->ipi_csum_flags & CSUM_TSO) { + sop->offload_mode = VMXNET3_OM_TSO; +- sop->hlen = hdrlen; ++ sop->hlen = hdrlen + pi->ipi_tcp_hlen; + sop->offload_pos = pi->ipi_tso_segsz; + } else if (pi->ipi_csum_flags & (VMXNET3_CSUM_OFFLOAD | + VMXNET3_CSUM_OFFLOAD_IPV6)) { Added: head/share/security/patches/EN-20:16/vmx.patch.asc ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/share/security/patches/EN-20:16/vmx.patch.asc Wed Aug 5 17:30:26 2020 (r54399) @@ -0,0 +1,18 @@ +-----BEGIN PGP SIGNATURE----- + +iQKTBAABCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAl8q63dfFIAAAAAALgAo +aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD +MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n +5cKCUg//TowAGFMQ0j1V6uIOnxlUWYu1RsFHqrUjh8QSeZmX8oz0B2IWLVzI8mk3 +9R2n4xUmuEVoF9WAR7gxhWuateUjAi4ksg2RdaFVb0Q2p8bQ6Tk2zj9wF5uy+CEQ +2pL0IzrsBc567CQjdhV8JfsHm0wa6BcZ8Pnr7AVVAUPY78XWdvamMupBxwil9zsC +zKCoxZdZk5xDe3kprWu90K5cdCxvvkJgzkVXZFzunqBbrpsjBlL4O5GQyMsFf4Ri +LJHieGwW6UhIAPYEu6tqTf0LanKbBxr/pgB+lD9b4W6YNSi5rEaPcNuBdCp5A/8L +OJjxXU7AUVRFe1YPP0m8FDonIi/5aEOF9VO6Fx5a3P3FBjpM/7CB34gfEv+ZIsrR +o27P7HhAmOdWw8nii50c9ukvhE66gNf3MglDAP6mB8YnSxHMpu5yqVQiGKjoO5hI +scxrlIDHzYWwc22mEJpZSVuuxMo7pFinKT0WwdNq3tSYpErNT4xvE1OT1ZTkRKB7 +bxWqbay7WGP9YHjq1vBgv9tt/iRB27Q0SsVsmGQchhoZANl03jU4wpO8ygAtRd0K +E13BhfaNQLzdByPQPhDLCflMqFHHC9IxKlHg9lVKb/CtDv52yh8/t21IrBy/iqJY +K5Ivn8GY3xOgCwQa5lXE0RzvMLkt4RjFqV++34jowXPyF9KT0ik= +=4RPg +-----END PGP SIGNATURE----- Added: head/share/security/patches/SA-20:21/usb_net.11.patch ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/share/security/patches/SA-20:21/usb_net.11.patch Wed Aug 5 17:30:26 2020 (r54399) @@ -0,0 +1,36 @@ +--- sys/dev/usb/net/if_smsc.c.orig ++++ sys/dev/usb/net/if_smsc.c +@@ -970,7 +970,7 @@ + struct mbuf *m; + struct usb_page_cache *pc; + uint32_t rxhdr; +- uint16_t pktlen; ++ int pktlen; + int off; + int actlen; + +@@ -996,6 +996,9 @@ + /* The frame header is always aligned on a 4 byte boundary */ + off = ((off + 0x3) & ~0x3); + ++ if ((off + sizeof(rxhdr)) > actlen) ++ goto tr_setup; ++ + usbd_copy_out(pc, off, &rxhdr, sizeof(rxhdr)); + off += (sizeof(rxhdr) + ETHER_ALIGN); + rxhdr = le32toh(rxhdr); +@@ -1024,7 +1027,13 @@ + if_inc_counter(ifp, IFCOUNTER_IQDROPS, 1); + goto tr_setup; + } +- ++ if (pktlen > m->m_len) { ++ smsc_dbg_printf(sc, "buffer too small %d vs %d bytes", ++ pktlen, m->m_len); ++ if_inc_counter(ifp, IFCOUNTER_IQDROPS, 1); ++ m_freem(m); ++ goto tr_setup; ++ } + usbd_copy_out(pc, off, mtod(m, uint8_t *), pktlen); + + /* Check if RX TCP/UDP checksumming is being offloaded */ Added: head/share/security/patches/SA-20:21/usb_net.11.patch.asc ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/share/security/patches/SA-20:21/usb_net.11.patch.asc Wed Aug 5 17:30:26 2020 (r54399) @@ -0,0 +1,18 @@ +-----BEGIN PGP SIGNATURE----- + +iQKTBAABCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAl8q63dfFIAAAAAALgAo +aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD +MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n +5cKxGw//bjW21aF/b5zZn8HaB7ZTah8MLuppHhcKzEfy2T3e95MXwd8t/ZYP/1Th +UwTGxO/mWHIZq9Ky6Y7oS1FUifOsbnaMZjQBioF/+dyRBApczitrIfyyVzL7hBFR +u2stVlIPAoNsa+XKKxxo/jRcHR3RAH3OL7nfN4Bt+sd39lkpWyP6rZxfmD/4Xnmv +YirpypsMFLI1APeIgk0OCOCME8ssmp8xa9GNt4nQ5ycBJSrqIU5p9q9jXyedKFUO +zgMf+TWJg8MG4OohmOn7nGXVK2ZVGT5yeW3Q41mqg96kGgV78wGWFYtHas7hBnH3 +aTt/oP2XjFY6VYlqwMSh9cqLgqrb9zg5G18Ip0p6wntPHFOFcUrwIjEXGShX+XPn +U9fwPYz1fRaVrflxLDQMZ9WHB4e8d9fW7wuDUkOcL7/8kMcvEvfU+tFGktstKj9w +pZm1IZ0o51L7IwEY6ZwJ4rx73P9e8A4KrbqZwAdDYcArnSZTkvtFS8KYwral4fP1 +6AfWoyaQijINjb+Jr7jPWn6JHeCSaFF7Vrb4wMtxQ5YL0SnTxqS2zFlrgJ0FNIM6 +YebqXVVKvJT+eQTc+LSxEWe73CYCvur9dksty48KpBbaADpwFqi4nUFFxP4L93If +0AlliNEI0YFu4uKh5EmBpr5wbX8KoTBczjTYoVIilerq4yMXSGc= +=ZUVD +-----END PGP SIGNATURE----- Added: head/share/security/patches/SA-20:21/usb_net.12.patch ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/share/security/patches/SA-20:21/usb_net.12.patch Wed Aug 5 17:30:26 2020 (r54399) @@ -0,0 +1,113 @@ +--- sys/dev/usb/net/if_cdceem.c.orig ++++ sys/dev/usb/net/if_cdceem.c +@@ -426,9 +426,10 @@ + struct usb_ether *ue; + struct ifnet *ifp; + struct mbuf *m; +- int actlen, off; + uint32_t computed_crc, received_crc; +- uint16_t pktlen; ++ int pktlen; ++ int actlen; ++ int off; + + off = *offp; + sc = usbd_xfer_softc(xfer); +@@ -442,7 +443,7 @@ + (hdr & CDCEEM_DATA_CRC) ? "valid" : "absent", + pktlen); + +- if (pktlen < ETHER_HDR_LEN) { ++ if (pktlen < (ETHER_HDR_LEN + 4)) { + CDCEEM_WARN(sc, + "bad ethernet frame length %d, should be at least %d", + pktlen, ETHER_HDR_LEN); +@@ -466,6 +467,14 @@ + } + + pktlen -= 4; /* Subtract the CRC. */ ++ ++ if (pktlen > m->m_len) { ++ CDCEEM_WARN(sc, "buffer too small %d vs %d bytes", ++ pktlen, m->m_len); ++ if_inc_counter(ifp, IFCOUNTER_IQDROPS, 1); ++ m_freem(m); ++ return; ++ } + usbd_copy_out(pc, off, mtod(m, uint8_t *), pktlen); + off += pktlen; + +@@ -512,7 +521,7 @@ + pc = usbd_xfer_get_frame(xfer, 0); + off = 0; + +- while (off < actlen) { ++ while ((off + sizeof(hdr)) <= actlen) { + usbd_copy_out(pc, off, &hdr, sizeof(hdr)); + CDCEEM_DEBUG(sc, "hdr = %#x", hdr); + off += sizeof(hdr); +--- sys/dev/usb/net/if_muge.c.orig ++++ sys/dev/usb/net/if_muge.c +@@ -1166,9 +1166,9 @@ + struct ifnet *ifp = uether_getifp(ue); + struct mbuf *m; + struct usb_page_cache *pc; +- uint16_t pktlen; + uint32_t rx_cmd_a, rx_cmd_b; + uint16_t rx_cmd_c; ++ int pktlen; + int off; + int actlen; + +@@ -1246,7 +1246,14 @@ + 1); + goto tr_setup; + } +- ++ if (pktlen > m->m_len) { ++ muge_dbg_printf(sc, ++ "buffer too small %d vs %d bytes", ++ pktlen, m->m_len); ++ if_inc_counter(ifp, IFCOUNTER_IQDROPS, 1); ++ m_freem(m); ++ goto tr_setup; ++ } + usbd_copy_out(pc, off, mtod(m, uint8_t *), + pktlen); + +--- sys/dev/usb/net/if_smsc.c.orig ++++ sys/dev/usb/net/if_smsc.c +@@ -973,7 +973,7 @@ + struct mbuf *m; + struct usb_page_cache *pc; + uint32_t rxhdr; +- uint16_t pktlen; ++ int pktlen; + int off; + int actlen; + +@@ -999,6 +999,9 @@ + /* The frame header is always aligned on a 4 byte boundary */ + off = ((off + 0x3) & ~0x3); + ++ if ((off + sizeof(rxhdr)) > actlen) ++ goto tr_setup; ++ + usbd_copy_out(pc, off, &rxhdr, sizeof(rxhdr)); + off += (sizeof(rxhdr) + ETHER_ALIGN); + rxhdr = le32toh(rxhdr); +@@ -1027,7 +1030,13 @@ + if_inc_counter(ifp, IFCOUNTER_IQDROPS, 1); + goto tr_setup; + } +- ++ if (pktlen > m->m_len) { ++ smsc_dbg_printf(sc, "buffer too small %d vs %d bytes", ++ pktlen, m->m_len); ++ if_inc_counter(ifp, IFCOUNTER_IQDROPS, 1); ++ m_freem(m); ++ goto tr_setup; ++ } + usbd_copy_out(pc, off, mtod(m, uint8_t *), pktlen); + + /* Check if RX TCP/UDP checksumming is being offloaded */ Added: head/share/security/patches/SA-20:21/usb_net.12.patch.asc ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/share/security/patches/SA-20:21/usb_net.12.patch.asc Wed Aug 5 17:30:26 2020 (r54399) @@ -0,0 +1,18 @@ +-----BEGIN PGP SIGNATURE----- + +iQKTBAABCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAl8q63dfFIAAAAAALgAo +aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD +MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n +5cK/Rw/9EPrYfgoU/y0Qjp45sx8QyLcTrWasG2pwQT1PJZjes/KviQzy821uTtZG +fJqsAECKUf1Tkr3iKUzfHXFbTEb+oZgm2wbTzeqTSkzEDxd/psRJlA5D6tWk2sN6 +Ws4FzKSzMSM6YVreT0ITm7hwIV1qW1KcN7pjy3YQZtwrK6vYDV5MFB7qHdPe6uLF +hXofqIrw2pyiH7Z6Ok1cIgPqdBVV6t2xpU0daRGSSFIEAoguS2J+tUs8NsjWh1wf +Ihu7o185Z54q4u91vWTYTqBFe1rXmDX6GQgS1qIV3z43woHRy5otedolQBDpPCqz +mcNbITrDkU/ngx9UorJqyD6+hNuo73Px6Qyz0szGlpHeCupAbhCTt/vKj9FGcN+p +q9on5FlGJiZ5KK0JBixzAzTLpjxVyTSEypaOLtTrgNhWcJBL6o0GQqLp+9lv2M9A +x7CfVrrs75H1P44fZnVIr46evxq+I1Si6VCaVtamdQQqz5voawyjhgX7nwsw0gts +BicZVomn+b9EBH2kCIEa20CXIVE76F891JTBBcuasE2+aRI83NTnNfKiBRvizueE +I7BuZfOxm8+lE0A790sA+TbIaNpPZolRWdsV205IKrjDEo0VluJwrdQalUZ7pAxA +IZ07rDKbswFKGLxitlnOL4zWv2xsOKPGh+HcI5gUHGbChTSaH8g= +=pBal +-----END PGP SIGNATURE----- Added: head/share/security/patches/SA-20:22/sqlite.11.3.patch ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/share/security/patches/SA-20:22/sqlite.11.3.patch Wed Aug 5 17:30:26 2020 (r54399) @@ -0,0 +1,47236 @@ +--- contrib/sqlite3/Makefile.msc.orig ++++ contrib/sqlite3/Makefile.msc +@@ -73,7 +73,7 @@ + !IFNDEF NO_WARN + !IF $(USE_FULLWARN)!=0 + NO_WARN = -wd4054 -wd4055 -wd4100 -wd4127 -wd4130 -wd4152 -wd4189 -wd4206 +-NO_WARN = $(NO_WARN) -wd4210 -wd4232 -wd4305 -wd4306 -wd4702 -wd4706 ++NO_WARN = $(NO_WARN) -wd4210 -wd4232 -wd4244 -wd4305 -wd4306 -wd4702 -wd4706 + !ENDIF + !ENDIF + +@@ -196,6 +196,7 @@ + DEBUG = 0 + !ENDIF + ++ + # Enable use of available compiler optimizations? Normally, this should be + # non-zero. Setting this to zero, thus disabling all compiler optimizations, + # can be useful for testing. +@@ -210,6 +211,12 @@ + SESSION = 0 + !ENDIF + ++# Set this to non-0 to enable support for the rbu extension. ++# ++!IFNDEF RBU ++RBU = 0 ++!ENDIF ++ + # Set the source code file to be used by executables and libraries when + # they need the amalgamation. + # +@@ -282,7 +289,7 @@ + OPT_FEATURE_FLAGS = $(OPT_FEATURE_FLAGS) -DSQLITE_ENABLE_STMTVTAB=1 + OPT_FEATURE_FLAGS = $(OPT_FEATURE_FLAGS) -DSQLITE_ENABLE_DBPAGE_VTAB=1 + OPT_FEATURE_FLAGS = $(OPT_FEATURE_FLAGS) -DSQLITE_ENABLE_DBSTAT_VTAB=1 +-OPT_FEATURE_FLAGS = $(OPT_FEATURE_FLAGS) -DSQLITE_INTROSPECTION_PRAGMAS=1 ++OPT_FEATURE_FLAGS = $(OPT_FEATURE_FLAGS) -DSQLITE_ENABLE_BYTECODE_VTAB=1 + OPT_FEATURE_FLAGS = $(OPT_FEATURE_FLAGS) -DSQLITE_ENABLE_DESERIALIZE=1 + !ENDIF + OPT_FEATURE_FLAGS = $(OPT_FEATURE_FLAGS) -DSQLITE_ENABLE_COLUMN_METADATA=1 +@@ -296,6 +303,13 @@ + OPT_FEATURE_FLAGS = $(OPT_FEATURE_FLAGS) -DSQLITE_ENABLE_PREUPDATE_HOOK=1 + !ENDIF + ++# Should the rbu extension be enabled? If so, add compilation options ++# to enable it. ++# ++!IF $(RBU)!=0 ++OPT_FEATURE_FLAGS = $(OPT_FEATURE_FLAGS) -DSQLITE_ENABLE_RBU=1 ++!ENDIF ++ + # These are the "extended" SQLite compilation options used when compiling for + # the Windows 10 platform. + # +@@ -978,7 +992,7 @@ + sqlite3.def: Replace.exe $(LIBOBJ) + echo EXPORTS > sqlite3.def + dumpbin /all $(LIBOBJ) \ +- | .\Replace.exe "^\s+/EXPORT:_?(sqlite3(?:session|changeset|changegroup|rebaser)?_[^@,]*)(?:@\d+|,DATA)?$$" $$1 true \ ++ | .\Replace.exe "^\s+/EXPORT:_?(sqlite3(?:session|changeset|changegroup|rebaser|rbu)?_[^@,]*)(?:@\d+|,DATA)?$$" $$1 true \ + | sort >> sqlite3.def + + $(SQLITE3EXE): shell.c $(SHELL_CORE_DEP) $(LIBRESOBJS) $(SHELL_CORE_SRC) $(SQLITE3H) +--- contrib/sqlite3/configure.orig ++++ contrib/sqlite3/configure +@@ -1,6 +1,6 @@ + #! /bin/sh + # Guess values for system-dependent variables and create Makefiles. +-# Generated by GNU Autoconf 2.69 for sqlite 3.28.0. ++# Generated by GNU Autoconf 2.69 for sqlite 3.32.2. + # + # Report bugs to <http://www.sqlite.org>. + # +@@ -590,8 +590,8 @@ + # Identity of this package. + PACKAGE_NAME='sqlite' + PACKAGE_TARNAME='sqlite' +-PACKAGE_VERSION='3.28.0' +-PACKAGE_STRING='sqlite 3.28.0' ++PACKAGE_VERSION='3.32.2' ++PACKAGE_STRING='sqlite 3.32.2' + PACKAGE_BUGREPORT='http://www.sqlite.org' + PACKAGE_URL='' + +@@ -1341,7 +1341,7 @@ + # Omit some internal or obsolete options to make the list less imposing. + # This message is too long to be a string in the A/UX 3.1 sh. + cat <<_ACEOF +-\`configure' configures sqlite 3.28.0 to adapt to many kinds of systems. ++\`configure' configures sqlite 3.32.2 to adapt to many kinds of systems. + + Usage: $0 [OPTION]... [VAR=VALUE]... + +@@ -1412,7 +1412,7 @@ + + if test -n "$ac_init_help"; then + case $ac_init_help in +- short | recursive ) echo "Configuration of sqlite 3.28.0:";; ++ short | recursive ) echo "Configuration of sqlite 3.32.2:";; + esac + cat <<\_ACEOF + +@@ -1537,7 +1537,7 @@ + test -n "$ac_init_help" && exit $ac_status + if $ac_init_version; then + cat <<\_ACEOF +-sqlite configure 3.28.0 ++sqlite configure 3.32.2 + generated by GNU Autoconf 2.69 + + Copyright (C) 2012 Free Software Foundation, Inc. +@@ -1952,7 +1952,7 @@ + This file contains any messages produced by compilers while + running configure, to aid debugging if configure makes a mistake. + +-It was created by sqlite $as_me 3.28.0, which was ++It was created by sqlite $as_me 3.32.2, which was + generated by GNU Autoconf 2.69. Invocation command line was + + $ $0 $@ +@@ -2818,7 +2818,7 @@ + + # Define the identity of the package. + PACKAGE='sqlite' +- VERSION='3.28.0' ++ VERSION='3.32.2' + + + cat >>confdefs.h <<_ACEOF +@@ -13653,7 +13653,7 @@ + fi + + if test x"$enable_rtree" = "xyes"; then +- BUILD_CFLAGS="$BUILD_CFLAGS -DSQLITE_ENABLE_RTREE" ++ BUILD_CFLAGS="$BUILD_CFLAGS -DSQLITE_ENABLE_RTREE -DSQLITE_ENABLE_GEOPOLY" + fi + #----------------------------------------------------------------------- + +@@ -14438,7 +14438,7 @@ + # report actual input values of CONFIG_FILES etc. instead of their + # values after options handling. + ac_log=" +-This file was extended by sqlite $as_me 3.28.0, which was ++This file was extended by sqlite $as_me 3.32.2, which was + generated by GNU Autoconf 2.69. Invocation command line was + + CONFIG_FILES = $CONFIG_FILES +@@ -14495,7 +14495,7 @@ + cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 + ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`" + ac_cs_version="\\ +-sqlite config.status 3.28.0 ++sqlite config.status 3.32.2 + configured by $0, generated by GNU Autoconf 2.69, + with options \\"\$ac_cs_config\\" + +--- contrib/sqlite3/configure.ac.orig ++++ contrib/sqlite3/configure.ac +@@ -10,7 +10,7 @@ + # + + AC_PREREQ(2.61) +-AC_INIT(sqlite, 3.28.0, http://www.sqlite.org) ++AC_INIT(sqlite, 3.32.2, http://www.sqlite.org) + AC_CONFIG_SRCDIR([sqlite3.c]) + AC_CONFIG_AUX_DIR([.]) + +@@ -161,7 +161,7 @@ + [--enable-rtree], [include rtree support [default=yes]])], + [], [enable_rtree=yes]) + if test x"$enable_rtree" = "xyes"; then +- BUILD_CFLAGS="$BUILD_CFLAGS -DSQLITE_ENABLE_RTREE" ++ BUILD_CFLAGS="$BUILD_CFLAGS -DSQLITE_ENABLE_RTREE -DSQLITE_ENABLE_GEOPOLY" + fi *** DIFF OUTPUT TRUNCATED AT 1000 LINES ***
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202008051730.075HURbY007286>