From owner-freebsd-current@freebsd.org Wed Jun 28 15:08:51 2017 Return-Path: Delivered-To: freebsd-current@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 252A5DA4252 for ; Wed, 28 Jun 2017 15:08:51 +0000 (UTC) (envelope-from mack@macktronics.com) Received: from borg.macktronics.com (gw.macktronics.com [209.181.253.70]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 032357C980 for ; Wed, 28 Jun 2017 15:08:50 +0000 (UTC) (envelope-from mack@macktronics.com) Received: from carob.macktronics.com (olive.macktronics.com [209.181.253.66]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by borg.macktronics.com (Postfix) with ESMTPS id 537C1469; Wed, 28 Jun 2017 10:08:49 -0500 (CDT) Date: Wed, 28 Jun 2017 10:08:45 -0500 (CDT) From: Dan Mack X-X-Sender: mack@localhost.local To: Jov cc: freebsd-current Subject: Re: fixes for stack clash vulnerability In-Reply-To: Message-ID: References: User-Agent: Alpine 2.11 (GSO 23 2013-08-11) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=utf-8; format=flowed Content-Transfer-Encoding: 8BIT X-Content-Filtered-By: Mailman/MimeDel 2.1.23 X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 Jun 2017 15:08:51 -0000 Thanks Jov - I missed it! Looks like it will MFC around Saturday :-) Dan On Wed, 28 Jun 2017, Jov wrote: > There is a commit fix this: https://svnweb.freebsd.org/changeset/base/320317 > > Jov > > 2017年6月28日 10:27 PM，"Dan Mack" 写道： > >> FreeBSD is mentioned as being vulnerable to this and Qualsys has working >> exploits which might be released soon: >> >> https://blog.qualys.com/securitylabs/2017/06/19/the-stack-clash >> >> I don't remember seeing an advisory or seeing any fixes on the svn commit >> stream so just curious. >> >> Dan >> _______________________________________________ >> freebsd-current@freebsd.org mailing list >> https://lists.freebsd.org/mailman/listinfo/freebsd-current >> To unsubscribe, send any mail to "freebsd-current-unsubscribe@freebsd.org" >> > _______________________________________________ > freebsd-current@freebsd.org mailing list > https://lists.freebsd.org/mailman/listinfo/freebsd-current > To unsubscribe, send any mail to "freebsd-current-unsubscribe@freebsd.org" From owner-freebsd-current@freebsd.org Wed Jun 28 21:38:46 2017 Return-Path: Delivered-To: freebsd-current@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id D4B25DAA2E7 for ; Wed, 28 Jun 2017 21:38:46 +0000 (UTC) (envelope-from markmi@dsl-only.net) Received: from asp.reflexion.net (outbound-mail-210-15.reflexion.net [208.70.210.15]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 73AE8353F for ; Wed, 28 Jun 2017 21:38:45 +0000 (UTC) (envelope-from markmi@dsl-only.net) Received: (qmail 9833 invoked from network); 28 Jun 2017 21:42:57 -0000 Received: from unknown (HELO mail-cs-02.app.dca.reflexion.local) (10.81.19.2) by 0 (rfx-qmail) with SMTP; 28 Jun 2017 21:42:57 -0000 Received: by mail-cs-02.app.dca.reflexion.local (Reflexion email security v8.40.1) with SMTP; Wed, 28 Jun 2017 17:38:44 -0400 (EDT) Received: (qmail 7666 invoked from network); 28 Jun 2017 21:38:43 -0000 Received: from unknown (HELO iron2.pdx.net) (69.64.224.71) by 0 (rfx-qmail) with (AES256-SHA encrypted) SMTP; 28 Jun 2017 21:38:43 -0000 Received: from [192.168.1.114] (c-76-115-7-162.hsd1.or.comcast.net [76.115.7.162]) by iron2.pdx.net (Postfix) with ESMTPSA id 3E299EC8FE9; Wed, 28 Jun 2017 14:38:43 -0700 (PDT) From: Mark Millard Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Subject: Re: fixes for stack clash vulnerability Message-Id: <62FACC92-DB52-4792-B11A-E356149C7475@dsl-only.net> Date: Wed, 28 Jun 2017 14:38:42 -0700 To: amutu@amutu.com, mack@macktronics.com, FreeBSD Current X-Mailer: Apple Mail (2.3273) X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 Jun 2017 21:38:46 -0000 Jov amutu at amutu.com wrote on Wed Jun 28 14:40:16 UTC 2017 > There is a commit fix this: = https://svnweb.freebsd.org/changeset/base/320317 Unfortunately the change broke other behavior resulting in some failing stack allocations for new threads and so there is also now: https://lists.freebsd.org/pipermail/svn-src-head/2017-June/102259.html and its: https://svnweb.freebsd.org/changeset/base/320430 to keep the overall system behavior correct. (At least that is my understanding of the relationship between those two commits.) =3D=3D=3D Mark Millard markmi at dsl-only.net