diff --git a/.gitignore b/.gitignore index e69de29..57225db 100644 --- a/.gitignore +++ b/.gitignore @@ -0,0 +1,2 @@ +SOURCES/kernel-3.10.0-1160.105.1.el7.src.rpm +SOURCES/v0.9.2.tar.gz diff --git a/.kpatch-patch-3_10_0-1160_105_1.metadata b/.kpatch-patch-3_10_0-1160_105_1.metadata index e69de29..3da4fc8 100644 --- a/.kpatch-patch-3_10_0-1160_105_1.metadata +++ b/.kpatch-patch-3_10_0-1160_105_1.metadata @@ -0,0 +1,2 @@ +f222cd5194fcb01324e91b4a617541d057951a2d SOURCES/kernel-3.10.0-1160.105.1.el7.src.rpm +c0878679129add77d6fff57093640892ad941155 SOURCES/v0.9.2.tar.gz diff --git a/SOURCES/CVE-2023-42753.patch b/SOURCES/CVE-2023-42753.patch new file mode 100644 index 0000000..2f76752 --- /dev/null +++ b/SOURCES/CVE-2023-42753.patch @@ -0,0 +1,107 @@ +From 6631a62473656c61d7f82cda8ba490c9ba952b96 Mon Sep 17 00:00:00 2001 +From: Joe Lawrence +Date: Mon, 27 Nov 2023 15:50:24 -0500 +Subject: [KPATCH CVE-2023-42753] kpatch fixes for CVE-2023-42753 + +Kernels: +3.10.0-1160.92.1.el7 +3.10.0-1160.95.1.el7 +3.10.0-1160.99.1.el7 +3.10.0-1160.102.1.el7 +3.10.0-1160.105.1.el7 + + +Kpatch-MR: https://gitlab.com/redhat/prdsc/rhel/src/kpatch/rhel-7/-/merge_requests/64 +Approved-by: Yannick Cote (@ycote1) +Changes since last build: +arches: x86_64 ppc64le +ip_set_hash_netportnet.o: changed function: hash_netportnet4_uadt +ip_set_hash_netportnet.o: changed function: hash_netportnet6_uadt +--------------------------- + +Modifications: +- Z-stream sets IP_SET_HASH_WITH_NET0, which kicks off a bunch of + preprocessor defined function and data changes, including struct + hash_netportnet{4,6}.nets[] array sizing and iteration. Instead of + deploying shadow variables to trace new/old instances, just reject + CIDR/CIDR2 if they are 0, i.e. remove support for /0 wildcard matching + so users get an error when they try to insert a new /0 element. + +commit 8de5d63e7ee39b62f71af7cd95990d99d300e8ec +Author: Phil Sutter +Date: Wed Nov 22 19:24:24 2023 +0100 + + netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c + + JIRA: https://issues.redhat.com/browse/RHEL-8433 + Upstream Status: commit 050d91c03b28ca479df13dfb02bcd2c60dd6a878 + CVE: CVE-2023-42753 + + commit 050d91c03b28ca479df13dfb02bcd2c60dd6a878 + Author: Kyle Zeng + Date: Tue Sep 5 15:04:09 2023 -0700 + + netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c + + The missing IP_SET_HASH_WITH_NET0 macro in ip_set_hash_netportnet can + lead to the use of wrong `CIDR_POS(c)` for calculating array offsets, + which can lead to integer underflow. As a result, it leads to slab + out-of-bound access. + This patch adds back the IP_SET_HASH_WITH_NET0 macro to + ip_set_hash_netportnet to address the issue. + + Fixes: 886503f34d63 ("netfilter: ipset: actually allow allowable CIDR 0 in hash:net,port,net") + Suggested-by: Jozsef Kadlecsik + Signed-off-by: Kyle Zeng + Acked-by: Jozsef Kadlecsik + Signed-off-by: Florian Westphal + + Signed-off-by: Phil Sutter + +Signed-off-by: Joe Lawrence +--- + net/netfilter/ipset/ip_set_hash_netportnet.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/net/netfilter/ipset/ip_set_hash_netportnet.c b/net/netfilter/ipset/ip_set_hash_netportnet.c +index 613e18e720a4..57043081d04c 100644 +--- a/net/netfilter/ipset/ip_set_hash_netportnet.c ++++ b/net/netfilter/ipset/ip_set_hash_netportnet.c +@@ -213,12 +213,16 @@ hash_netportnet4_uadt(struct ip_set *set, struct nlattr *tb[], + + if (tb[IPSET_ATTR_CIDR]) { + e.cidr[0] = nla_get_u8(tb[IPSET_ATTR_CIDR]); ++ if (e.cidr[0] == 0) ++ return -IPSET_ERR_INVALID_CIDR; + if (e.cidr[0] > HOST_MASK) + return -IPSET_ERR_INVALID_CIDR; + } + + if (tb[IPSET_ATTR_CIDR2]) { + e.cidr[1] = nla_get_u8(tb[IPSET_ATTR_CIDR2]); ++ if (e.cidr[1] == 0) ++ return -IPSET_ERR_INVALID_CIDR; + if (e.cidr[1] > HOST_MASK) + return -IPSET_ERR_INVALID_CIDR; + } +@@ -493,12 +497,16 @@ hash_netportnet6_uadt(struct ip_set *set, struct nlattr *tb[], + + if (tb[IPSET_ATTR_CIDR]) { + e.cidr[0] = nla_get_u8(tb[IPSET_ATTR_CIDR]); ++ if (e.cidr[0] == 0) ++ return -IPSET_ERR_INVALID_CIDR; + if (e.cidr[0] > HOST_MASK) + return -IPSET_ERR_INVALID_CIDR; + } + + if (tb[IPSET_ATTR_CIDR2]) { + e.cidr[1] = nla_get_u8(tb[IPSET_ATTR_CIDR2]); ++ if (e.cidr[1] == 0) ++ return -IPSET_ERR_INVALID_CIDR; + if (e.cidr[1] > HOST_MASK) + return -IPSET_ERR_INVALID_CIDR; + } +-- +2.43.0 + + diff --git a/SOURCES/v0.9.2-backport-MR-1200-Make-sure-section-symbols-ex.patch b/SOURCES/v0.9.2-backport-MR-1200-Make-sure-section-symbols-ex.patch new file mode 100644 index 0000000..2aec990 --- /dev/null +++ b/SOURCES/v0.9.2-backport-MR-1200-Make-sure-section-symbols-ex.patch @@ -0,0 +1,83 @@ +From c1a07a5329c0b7db0ec54eea093e5d2d77735c06 Mon Sep 17 00:00:00 2001 +From: Joe Lawrence +Date: Fri, 9 Dec 2022 15:37:49 -0500 +Subject: [PATCH] v0.9.2 backport: MR!1200 ("Make sure section symbols exist") +Content-type: text/plain + +commit 5622e3cc3d393fd77866b9838d16cd064de6fba5 +Author: Artem Savkov +Date: Fri Jun 18 10:59:26 2021 +0200 + + Make sure section symbols exist + + Binutils recently became much more aggressive about removing unused + section symbols. Since we can not rely on those being available anymore + add additional checks before using them. + + Fixes: #1193 + + Signed-off-by: Artem Savkov + +Fixes: KLP-216 ("Backport kpatch-build section symbol check") +Signed-off-by: Joe Lawrence +--- + kpatch-build/create-diff-object.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +diff --git a/kpatch-build/create-diff-object.c b/kpatch-build/create-diff-object.c +index c9afe33bbdae..94879b5fce6a 100644 +--- a/kpatch-build/create-diff-object.c ++++ b/kpatch-build/create-diff-object.c +@@ -1241,7 +1241,8 @@ static void kpatch_correlate_static_local_variables(struct kpatch_elf *base, + if (bundled && sym->sec->twin) { + UNCORRELATE_ELEMENT(sym->sec); + +- UNCORRELATE_ELEMENT(sym->sec->secsym); ++ if (sym->sec->secsym) ++ UNCORRELATE_ELEMENT(sym->sec->secsym); + + if (sym->sec->rela) + UNCORRELATE_ELEMENT(sym->sec->rela); +@@ -1744,7 +1745,7 @@ static int kpatch_include_callback_elements(struct kpatch_elf *kelf) + sym = rela->sym; + log_normal("found callback: %s\n",sym->name); + kpatch_include_symbol(sym); +- } else { ++ } else if (sec->secsym) { + sec->secsym->include = 1; + } + } +@@ -1772,7 +1773,8 @@ static void kpatch_include_force_elements(struct kpatch_elf *kelf) + sec->include = 1; + if (!is_rela_section(sec)) { + /* .kpatch.force */ +- sec->secsym->include = 1; ++ if (sec->secsym) ++ sec->secsym->include = 1; + continue; + } + /* .rela.kpatch.force */ +@@ -2381,7 +2383,8 @@ static void kpatch_regenerate_special_section(struct kpatch_elf *kelf, + sec->include = 1; + sec->base->include = 1; + /* include secsym so .kpatch.arch relas can point to section symbols */ +- sec->base->secsym->include = 1; ++ if (sec->base->secsym) ++ sec->base->secsym->include = 1; + + /* + * Update text section data buf and size. +@@ -2564,7 +2567,9 @@ static void kpatch_mark_ignored_sections(struct kpatch_elf *kelf) + * from the section data comparison, but this is a simpler way. + */ + strsec->include = 1; +- strsec->secsym->include = 1; ++ if (strsec->secsym) ++ strsec->secsym->include = 1; ++ + name = strsec->data->d_buf + rela->addend; + ignoresec = find_section_by_name(&kelf->sections, name); + if (!ignoresec) +-- +2.38.1 + diff --git a/SOURCES/v0.9.2-backport-MR-1281-create-diff-object-add-suppo.patch b/SOURCES/v0.9.2-backport-MR-1281-create-diff-object-add-suppo.patch new file mode 100644 index 0000000..38ef70c --- /dev/null +++ b/SOURCES/v0.9.2-backport-MR-1281-create-diff-object-add-suppo.patch @@ -0,0 +1,54 @@ +From d98f100dc979f87296ec88b63a0d506aaf4cd2bd Mon Sep 17 00:00:00 2001 +From: Joe Lawrence +Date: Thu, 8 Dec 2022 12:31:17 -0500 +Subject: [PATCH] v0.9.2 backport: MR!1281 ("create-diff-object: add support + for .return_sites section (x86)") +Content-type: text/plain + +commit 33368a88cdf875b0edd02b0dfd3356a7e93b24db +Author: Jonathan Dobson +Date: Sat Jul 16 15:46:54 2022 -0600 + + create-diff-object: add support for .return_sites section (x86) + + Conflicts: + kpatch-build/create-diff-object.c + - Manually apply patch to avoid diff context, v0.9.2 structure + special_section structure doesn't have .arch + +Signed-off-by: Joe Lawrence +--- + kpatch-build/create-diff-object.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/kpatch-build/create-diff-object.c b/kpatch-build/create-diff-object.c +index cee8adf333dc..c9afe33bbdae 100644 +--- a/kpatch-build/create-diff-object.c ++++ b/kpatch-build/create-diff-object.c +@@ -1991,6 +1991,11 @@ static int altinstructions_group_size(struct kpatch_elf *kelf, int offset) + return size; + } + ++static int return_sites_group_size(struct kpatch_elf *kelf, int offset) ++{ ++ return 4; ++} ++ + static int smp_locks_group_size(struct kpatch_elf *kelf, int offset) + { + return 4; +@@ -2103,6 +2108,11 @@ static struct special_section special_sections[] = { + .name = ".altinstructions", + .group_size = altinstructions_group_size, + }, ++ { ++ .name = ".return_sites", ++ .group_size = return_sites_group_size, ++ }, ++ + #endif + #ifdef __powerpc64__ + { +-- +2.38.1 + diff --git a/SPECS/kpatch-patch.spec b/SPECS/kpatch-patch.spec index 29010bc..c3bdf2c 100644 --- a/SPECS/kpatch-patch.spec +++ b/SPECS/kpatch-patch.spec @@ -1,17 +1,18 @@ # Set to 1 if building an empty subscription-only package. -%define empty_package 1 +%define empty_package 0 ####################################################### # Only need to update these variables and the changelog %define kernel_ver 3.10.0-1160.105.1.el7 %define kpatch_ver 0.9.2 -%define rpm_ver 0 -%define rpm_rel 0 +%define rpm_ver 1 +%define rpm_rel 1 %if !%{empty_package} # Patch sources below. DO NOT REMOVE THIS LINE. -Source100: XXX.patch -#Source101: YYY.patch +# +# https://issues.redhat.com/browse/RHEL-8456 +Source100: CVE-2023-42753.patch # End of patch sources. DO NOT REMOVE THIS LINE. %endif @@ -146,5 +147,8 @@ It is only a method to subscribe to the kpatch stream for kernel-%{kernel_ver}. %endif %changelog +* Fri Jan 05 2024 Yannick Cote [1-1.el7] +- kernel: netfilter: potential slab-out-of-bound access due to integer underflow [RHEL-8456] {CVE-2023-42753} + * Wed Nov 08 2023 Yannick Cote [0-0.el7] - An empty patch to subscribe to kpatch stream for kernel-3.10.0-1160.105.1.el7 [RHEL-16012]