==========================================================================
Ubuntu Security Notice USN-4748-1
February 25, 2021
linux, linux-aws, linux-kvm, linux-lts-xenial, linux-raspi2,
linux-snapdragon vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
- Ubuntu 14.04 ESM
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux: Linux kernel
- linux-aws: Linux kernel for Amazon Web Services (AWS) systems
- linux-kvm: Linux kernel for cloud environments
- linux-raspi2: Linux kernel for Raspberry Pi (V8) systems
- linux-snapdragon: Linux kernel for Qualcomm Snapdragon processors
- linux-lts-xenial: Linux hardware enablement kernel from Xenial for Trusty
Details:
It was discovered that the jfs file system implementation in the Linux
kernel contained an out-of-bounds read vulnerability. A local attacker
could use this to possibly cause a denial of service (system crash).
(CVE-2020-27815)
It was discovered that the memory management subsystem in the Linux kernel
did not properly handle copy-on-write operations in some situations. A
local attacker could possibly use this to gain unintended write access to
read-only memory pages. (CVE-2020-29374)
Michael Kurth and Pawel Wieczorkiewicz discovered that the Xen event
processing backend in the Linux kernel did not properly limit the number of
events queued. An attacker in a guest VM could use this to cause a denial
of service in the host OS. (CVE-2020-29568)
Jann Horn discovered that the tty subsystem of the Linux kernel did not use
consistent locking in some situations, leading to a read-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly expose sensitive information (kernel memory).
(CVE-2020-29660)
Jann Horn discovered a race condition in the tty subsystem of the Linux
kernel in the locking for the TIOCSPGRP ioctl(), leading to a use-after-
free vulnerability. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2020-29661)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
linux-image-4.4.0-1088-kvm 4.4.0-1088.97
linux-image-4.4.0-1122-aws 4.4.0-1122.136
linux-image-4.4.0-1146-raspi2 4.4.0-1146.156
linux-image-4.4.0-1150-snapdragon 4.4.0-1150.160
linux-image-4.4.0-203-generic 4.4.0-203.235
linux-image-4.4.0-203-generic-lpae 4.4.0-203.235
linux-image-4.4.0-203-lowlatency 4.4.0-203.235
linux-image-4.4.0-203-powerpc-e500mc 4.4.0-203.235
linux-image-4.4.0-203-powerpc-smp 4.4.0-203.235
linux-image-4.4.0-203-powerpc64-emb 4.4.0-203.235
linux-image-4.4.0-203-powerpc64-smp 4.4.0-203.235
linux-image-aws 4.4.0.1122.127
linux-image-generic 4.4.0.203.209
linux-image-generic-lpae 4.4.0.203.209
linux-image-kvm 4.4.0.1088.86
linux-image-lowlatency 4.4.0.203.209
linux-image-powerpc-e500mc 4.4.0.203.209
linux-image-powerpc-smp 4.4.0.203.209
linux-image-powerpc64-emb 4.4.0.203.209
linux-image-powerpc64-smp 4.4.0.203.209
linux-image-raspi2 4.4.0.1146.146
linux-image-snapdragon 4.4.0.1150.142
linux-image-virtual 4.4.0.203.209
Ubuntu 14.04 ESM:
linux-image-4.4.0-1086-aws 4.4.0-1086.90
linux-image-4.4.0-203-generic 4.4.0-203.235~14.04.1
linux-image-4.4.0-203-generic-lpae 4.4.0-203.235~14.04.1
linux-image-4.4.0-203-lowlatency 4.4.0-203.235~14.04.1
linux-image-4.4.0-203-powerpc-e500mc 4.4.0-203.235~14.04.1
linux-image-4.4.0-203-powerpc-smp 4.4.0-203.235~14.04.1
linux-image-4.4.0-203-powerpc64-emb 4.4.0-203.235~14.04.1
linux-image-4.4.0-203-powerpc64-smp 4.4.0-203.235~14.04.1
linux-image-aws 4.4.0.1086.83
linux-image-generic-lpae-lts-xenial 4.4.0.203.177
linux-image-generic-lts-xenial 4.4.0.203.177
linux-image-lowlatency-lts-xenial 4.4.0.203.177
linux-image-powerpc-e500mc-lts-xenial 4.4.0.203.177
linux-image-powerpc-smp-lts-xenial 4.4.0.203.177
linux-image-powerpc64-emb-lts-xenial 4.4.0.203.177
linux-image-powerpc64-smp-lts-xenial 4.4.0.203.177
linux-image-virtual-lts-xenial 4.4.0.203.177
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://usn.ubuntu.com/4748-1
CVE-2020-27815, CVE-2020-29374, CVE-2020-29568, CVE-2020-29660,
CVE-2020-29661
Package Information:
https://launchpad.net/ubuntu/+source/linux/4.4.0-203.235
https://launchpad.net/ubuntu/+source/linux-aws/4.4.0-1122.136
https://launchpad.net/ubuntu/+source/linux-kvm/4.4.0-1088.97
https://launchpad.net/ubuntu/+source/linux-raspi2/4.4.0-1146.156
https://launchpad.net/ubuntu/+source/linux-snapdragon/4.4.0-1150.160
Thursday, February 25, 2021
Wednesday, February 24, 2021
[USN-4747-2] GNU Screen vulnerability
==========================================================================
Ubuntu Security Notice USN-4747-2
February 24, 2021
screen vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 ESM
Summary:
GNU Screen could be made to crash or run programs if it processed specially
crafted character sequences.
Software Description:
- screen: terminal multiplexer with VT100/ANSI terminal emulation
Details:
USN-4747-1 fixed a vulnerability in screen. This update provides
the corresponding update for Ubuntu 14.04 ESM.
Original advisory details:
Felix Weinmann discovered that GNU Screen incorrectly handled certain
character sequences. A remote attacker could use this issue to cause GNU
Screen to crash, resulting in a denial of service, or possibly execute
arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 ESM:
screen 4.1.0~20120320gitdb59704-9ubuntu0.1~esm2
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4747-2
https://usn.ubuntu.com/4747-1
CVE-2021-26937
Ubuntu Security Notice USN-4747-2
February 24, 2021
screen vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 ESM
Summary:
GNU Screen could be made to crash or run programs if it processed specially
crafted character sequences.
Software Description:
- screen: terminal multiplexer with VT100/ANSI terminal emulation
Details:
USN-4747-1 fixed a vulnerability in screen. This update provides
the corresponding update for Ubuntu 14.04 ESM.
Original advisory details:
Felix Weinmann discovered that GNU Screen incorrectly handled certain
character sequences. A remote attacker could use this issue to cause GNU
Screen to crash, resulting in a denial of service, or possibly execute
arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 ESM:
screen 4.1.0~20120320gitdb59704-9ubuntu0.1~esm2
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4747-2
https://usn.ubuntu.com/4747-1
CVE-2021-26937
OpenBSD Errata: February 24th, 2021 (pffrag)
Errata patches for the kernel have been released for OpenBSD 6.7 and 6.8.
A sequence of overlapping IPv4 fragments could crash the kernel in
pf due to an assertion.
Binary updates for the amd64, i386, and arm64 platforms are available via
the syspatch utility. Source code patches can be found on the respective
errata page:
https://www.openbsd.org/errata67.html
https://www.openbsd.org/errata68.html
As these affect the kernel, a reboot will be needed after patching.
A sequence of overlapping IPv4 fragments could crash the kernel in
pf due to an assertion.
Binary updates for the amd64, i386, and arm64 platforms are available via
the syspatch utility. Source code patches can be found on the respective
errata page:
https://www.openbsd.org/errata67.html
https://www.openbsd.org/errata68.html
As these affect the kernel, a reboot will be needed after patching.
[USN-4746-1] xterm vulnerability
==========================================================================
Ubuntu Security Notice USN-4746-1
February 24, 2021
xterm vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
xterm could be made to crash or run programs if it handled specially
crafted character sequences.
Software Description:
- xterm: X terminal emulator
Details:
Tavis Ormandy discovered that xterm incorrectly handled certain character
sequences. A remote attacker could use this issue to cause xterm to crash,
resulting in a denial of service, or possibly execute arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.10:
xterm 353-1ubuntu1.20.10.2
Ubuntu 20.04 LTS:
xterm 353-1ubuntu1.20.04.2
Ubuntu 18.04 LTS:
xterm 330-1ubuntu2.2
Ubuntu 16.04 LTS:
xterm 322-1ubuntu1.2
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4746-1
CVE-2021-27135
Package Information:
https://launchpad.net/ubuntu/+source/xterm/353-1ubuntu1.20.10.2
https://launchpad.net/ubuntu/+source/xterm/353-1ubuntu1.20.04.2
https://launchpad.net/ubuntu/+source/xterm/330-1ubuntu2.2
https://launchpad.net/ubuntu/+source/xterm/322-1ubuntu1.2
Ubuntu Security Notice USN-4746-1
February 24, 2021
xterm vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
xterm could be made to crash or run programs if it handled specially
crafted character sequences.
Software Description:
- xterm: X terminal emulator
Details:
Tavis Ormandy discovered that xterm incorrectly handled certain character
sequences. A remote attacker could use this issue to cause xterm to crash,
resulting in a denial of service, or possibly execute arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.10:
xterm 353-1ubuntu1.20.10.2
Ubuntu 20.04 LTS:
xterm 353-1ubuntu1.20.04.2
Ubuntu 18.04 LTS:
xterm 330-1ubuntu2.2
Ubuntu 16.04 LTS:
xterm 322-1ubuntu1.2
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4746-1
CVE-2021-27135
Package Information:
https://launchpad.net/ubuntu/+source/xterm/353-1ubuntu1.20.10.2
https://launchpad.net/ubuntu/+source/xterm/353-1ubuntu1.20.04.2
https://launchpad.net/ubuntu/+source/xterm/330-1ubuntu2.2
https://launchpad.net/ubuntu/+source/xterm/322-1ubuntu1.2
[USN-4747-1] GNU Screen vulnerability
==========================================================================
Ubuntu Security Notice USN-4747-1
February 24, 2021
screen vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
GNU Screen could be made to crash or run programs if it processed specially
crafted character sequences.
Software Description:
- screen: terminal multiplexer with VT100/ANSI terminal emulation
Details:
Felix Weinmann discovered that GNU Screen incorrectly handled certain
character sequences. A remote attacker could use this issue to cause GNU
Screen to crash, resulting in a denial of service, or possibly execute
arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.10:
screen 4.8.0-2ubuntu0.1
Ubuntu 20.04 LTS:
screen 4.8.0-1ubuntu0.1
Ubuntu 18.04 LTS:
screen 4.6.2-1ubuntu1.1
Ubuntu 16.04 LTS:
screen 4.3.1-2ubuntu0.1
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4747-1
CVE-2021-26937
Package Information:
https://launchpad.net/ubuntu/+source/screen/4.8.0-2ubuntu0.1
https://launchpad.net/ubuntu/+source/screen/4.8.0-1ubuntu0.1
https://launchpad.net/ubuntu/+source/screen/4.6.2-1ubuntu1.1
https://launchpad.net/ubuntu/+source/screen/4.3.1-2ubuntu0.1
Ubuntu Security Notice USN-4747-1
February 24, 2021
screen vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
GNU Screen could be made to crash or run programs if it processed specially
crafted character sequences.
Software Description:
- screen: terminal multiplexer with VT100/ANSI terminal emulation
Details:
Felix Weinmann discovered that GNU Screen incorrectly handled certain
character sequences. A remote attacker could use this issue to cause GNU
Screen to crash, resulting in a denial of service, or possibly execute
arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.10:
screen 4.8.0-2ubuntu0.1
Ubuntu 20.04 LTS:
screen 4.8.0-1ubuntu0.1
Ubuntu 18.04 LTS:
screen 4.6.2-1ubuntu1.1
Ubuntu 16.04 LTS:
screen 4.3.1-2ubuntu0.1
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4747-1
CVE-2021-26937
Package Information:
https://launchpad.net/ubuntu/+source/screen/4.8.0-2ubuntu0.1
https://launchpad.net/ubuntu/+source/screen/4.8.0-1ubuntu0.1
https://launchpad.net/ubuntu/+source/screen/4.6.2-1ubuntu1.1
https://launchpad.net/ubuntu/+source/screen/4.3.1-2ubuntu0.1
[USN-4698-2] Dnsmasq regression
==========================================================================
Ubuntu Security Notice USN-4698-2
February 24, 2021
dnsmasq regression
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
USN-4698-1 introduced regressions in Dnsmasq.
Software Description:
- dnsmasq: Small caching DNS proxy and DHCP/TFTP server
Details:
USN-4698-1 fixed vulnerabilities in Dnsmasq. The updates introduced
regressions in certain environments related to issues with multiple
queries, and issues with retries. This update fixes the problem.
Original advisory details:
Moshe Kol and Shlomi Oberman discovered that Dnsmasq incorrectly handled
memory when sorting RRsets. A remote attacker could use this issue to cause
Dnsmasq to hang, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2020-25681, CVE-2020-25687)
Moshe Kol and Shlomi Oberman discovered that Dnsmasq incorrectly handled
extracting certain names. A remote attacker could use this issue to cause
Dnsmasq to hang, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2020-25682, CVE-2020-25683)
Moshe Kol and Shlomi Oberman discovered that Dnsmasq incorrectly
implemented address/port checks. A remote attacker could use this issue to
perform a cache poisoning attack. (CVE-2020-25684)
Moshe Kol and Shlomi Oberman discovered that Dnsmasq incorrectly
implemented query resource name checks. A remote attacker could use this
issue to perform a cache poisoning attack. (CVE-2020-25685)
Moshe Kol and Shlomi Oberman discovered that Dnsmasq incorrectly handled
multiple query requests for the same resource name. A remote attacker could
use this issue to perform a cache poisoning attack. (CVE-2020-25686)
It was discovered that Dnsmasq incorrectly handled memory during DHCP
response creation. A remote attacker could possibly use this issue to
cause Dnsmasq to consume resources, leading to a denial of service. This
issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04
LTS. (CVE-2019-14834)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.10:
dnsmasq 2.82-1ubuntu1.2
dnsmasq-base 2.82-1ubuntu1.2
dnsmasq-utils 2.82-1ubuntu1.2
Ubuntu 20.04 LTS:
dnsmasq 2.80-1.1ubuntu1.3
dnsmasq-base 2.80-1.1ubuntu1.3
dnsmasq-utils 2.80-1.1ubuntu1.3
Ubuntu 18.04 LTS:
dnsmasq 2.79-1ubuntu0.3
dnsmasq-base 2.79-1ubuntu0.3
dnsmasq-utils 2.79-1ubuntu0.3
Ubuntu 16.04 LTS:
dnsmasq 2.75-1ubuntu0.16.04.8
dnsmasq-base 2.75-1ubuntu0.16.04.8
dnsmasq-utils 2.75-1ubuntu0.16.04.8
After a standard system update you need to reboot your computer to make
all the necessary changes.
References:
https://usn.ubuntu.com/4698-2
https://usn.ubuntu.com/4698-1
https://launchpad.net/bugs/1916462
Package Information:
https://launchpad.net/ubuntu/+source/dnsmasq/2.82-1ubuntu1.2
https://launchpad.net/ubuntu/+source/dnsmasq/2.80-1.1ubuntu1.3
https://launchpad.net/ubuntu/+source/dnsmasq/2.79-1ubuntu0.3
https://launchpad.net/ubuntu/+source/dnsmasq/2.75-1ubuntu0.16.04.8
Ubuntu Security Notice USN-4698-2
February 24, 2021
dnsmasq regression
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
USN-4698-1 introduced regressions in Dnsmasq.
Software Description:
- dnsmasq: Small caching DNS proxy and DHCP/TFTP server
Details:
USN-4698-1 fixed vulnerabilities in Dnsmasq. The updates introduced
regressions in certain environments related to issues with multiple
queries, and issues with retries. This update fixes the problem.
Original advisory details:
Moshe Kol and Shlomi Oberman discovered that Dnsmasq incorrectly handled
memory when sorting RRsets. A remote attacker could use this issue to cause
Dnsmasq to hang, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2020-25681, CVE-2020-25687)
Moshe Kol and Shlomi Oberman discovered that Dnsmasq incorrectly handled
extracting certain names. A remote attacker could use this issue to cause
Dnsmasq to hang, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2020-25682, CVE-2020-25683)
Moshe Kol and Shlomi Oberman discovered that Dnsmasq incorrectly
implemented address/port checks. A remote attacker could use this issue to
perform a cache poisoning attack. (CVE-2020-25684)
Moshe Kol and Shlomi Oberman discovered that Dnsmasq incorrectly
implemented query resource name checks. A remote attacker could use this
issue to perform a cache poisoning attack. (CVE-2020-25685)
Moshe Kol and Shlomi Oberman discovered that Dnsmasq incorrectly handled
multiple query requests for the same resource name. A remote attacker could
use this issue to perform a cache poisoning attack. (CVE-2020-25686)
It was discovered that Dnsmasq incorrectly handled memory during DHCP
response creation. A remote attacker could possibly use this issue to
cause Dnsmasq to consume resources, leading to a denial of service. This
issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04
LTS. (CVE-2019-14834)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.10:
dnsmasq 2.82-1ubuntu1.2
dnsmasq-base 2.82-1ubuntu1.2
dnsmasq-utils 2.82-1ubuntu1.2
Ubuntu 20.04 LTS:
dnsmasq 2.80-1.1ubuntu1.3
dnsmasq-base 2.80-1.1ubuntu1.3
dnsmasq-utils 2.80-1.1ubuntu1.3
Ubuntu 18.04 LTS:
dnsmasq 2.79-1ubuntu0.3
dnsmasq-base 2.79-1ubuntu0.3
dnsmasq-utils 2.79-1ubuntu0.3
Ubuntu 16.04 LTS:
dnsmasq 2.75-1ubuntu0.16.04.8
dnsmasq-base 2.75-1ubuntu0.16.04.8
dnsmasq-utils 2.75-1ubuntu0.16.04.8
After a standard system update you need to reboot your computer to make
all the necessary changes.
References:
https://usn.ubuntu.com/4698-2
https://usn.ubuntu.com/4698-1
https://launchpad.net/bugs/1916462
Package Information:
https://launchpad.net/ubuntu/+source/dnsmasq/2.82-1ubuntu1.2
https://launchpad.net/ubuntu/+source/dnsmasq/2.80-1.1ubuntu1.3
https://launchpad.net/ubuntu/+source/dnsmasq/2.79-1ubuntu0.3
https://launchpad.net/ubuntu/+source/dnsmasq/2.75-1ubuntu0.16.04.8
[FreeBSD-Announce] FreeBSD Security Advisory FreeBSD-SA-21:04.jail_remove
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
=============================================================================
FreeBSD-SA-21:04.jail_remove Security Advisory
The FreeBSD Project
Topic: jail_remove(2) fails to kill all jailed processes
Category: core
Module: jail
Announced: 2021-02-24
Credits: Mateusz Guzik
Affects: All supported versions of FreeBSD.
Corrected: 2021-02-19 01:22:08 UTC (stable/13, 13.0-STABLE)
2021-02-19 21:53:07 UTC (releng/13.0, 13.0-BETA3-p1)
2021-02-19 21:46:31 UTC (stable/12, 12.2-STABLE)
2021-02-24 01:43:39 UTC (releng/12.2, 12.2-RELEASE-p4)
2021-02-19 21:50:26 UTC (stable/11, 11.4-STABLE)
2021-02-24 01:41:41 UTC (releng/11.4, 11.4-RELEASE-p8)
CVE Name: CVE-2020-25581
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.
I. Background
The jail(2) system call allows a system administrator to lock a process
and all of its descendants inside an environment with a very limited
ability to affect the system outside that environment, even for
processes with superuser privileges. It is an extension of, but
far more powerful than, the traditional UNIX chroot(2) system call.
The jail_remove(2) system call, which was introduced in FreeBSD 8.0,
allows a non-jailed process to remove a jail, which includes terminating
all the processes running in that jail.
II. Problem Description
Due to a race condition in the jail_remove(2) implementation, it may fail
to kill some of the processes.
III. Impact
A process running inside a jail can avoid being killed during jail termination.
If a jail is subsequently started with the same root path, a lingering jailed
process may be able to exploit the window during which a devfs filesystem is
mounted but the jail's devfs ruleset has not been applied, to access device
nodes which are ordinarily inaccessible. If the process is privileged, it may
be able to escape the jail and gain full access to the system.
IV. Workaround
The problem is limited to scenarios where a jail containing an untrusted,
privileged process is stopped, and a jail is subsequently started with the same
root path. Users not running jails are not affected, and the problem can be
avoided by not starting a jail with the same path as a previously stopped jail.
V. Solution
Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date and reboot.
Perform one of the following:
1) To update your vulnerable system via a binary patch:
Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
# shutdown -r +10min "Rebooting for a security update"
2) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
[FreeBSD 13.x]
# fetch https://security.FreeBSD.org/patches/SA-21:04/jail_remove.13.patch
# fetch https://security.FreeBSD.org/patches/SA-21:04/jail_remove.13.patch.asc
# gpg --verify jail_remove.13.patch.asc
[FreeBSD 11.x, FreeBSD 12.x]
# fetch https://security.FreeBSD.org/patches/SA-21:04/jail_remove.patch
# fetch https://security.FreeBSD.org/patches/SA-21:04/jail_remove.patch.asc
# gpg --verify jail_remove.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile your kernel as described in
<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
system.
VI. Correction details
The following list contains the correction revision numbers for each
affected branch.
Branch/path Revision
- -------------------------------------------------------------------------
stable/13/ 894360bacd42f021551f76518edd445f6d299f2e
releng/13.0/ 9f00cb5fa8a438e7b9efb2158f2e2edc730badd1
stable/12/ r369312
releng/12.2/ r369353
stable/11/ r369313
releng/11.4/ r369347
- -------------------------------------------------------------------------
[FreeBSD 13.x]
To see which files were modified by a particular revision, run the following
command in a checked out git repository, replacing NNNNNN with the revision
hash:
# git show --stat NNNNNN
Or visit the following URL, replace NNNNNN with the revision hash:
<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
[FreeBSD 11.x, FreeBSD 12.x]
To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
Or visit the following URL, replacing NNNNNN with the revision number:
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
VII. References
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25581>
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-21:04.jail_remove.asc>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAmA15dYACgkQ05eS9J6n
5cK69Q//UI2SeHrGXytm6ScQzCIbFPlUXlhkCX51WSOJmr/LUXpF9bcUhW73qqov
/c70VGF876woMXHkbfYnCVdB4ETLIqTbGOl2aw/c8fuwrmFdtyeDEQ4SRRfWgdC4
L6jEgMvB/fMO9e662k19f6RFXrdMspK4rOz3/aowTFbOEvD3Q0HpBUnFbWWg3Iiy
I190M0jbytFuZ2EJQ563bbRFFjEafZ51SKYz1FcR3cJAbVo/q75G3uDrjeNhnHxZ
0VqcTGHmF4Lh+RocUeW0v/1wHL8lBpoAKXmo4IL+FhFIR8fjVpKbGSm/IHSueatT
Tr6xOg93Ef+sETWVn9Jv26BAU06LEM/ZuXz+HS7T7DwnJJeKa3d74KTJnnGauE24
67OO0i4Fok9Yyy2ArBH8V8mnzdW96dJyHrwdG0UUBddYlEyzArxkUQZyoIdj1Gb1
fns8ndY8t5tky2fxHZG2UMBWwQKBtbMZY027JRylAJWExsG6wH7DcUJ51FpcnbNe
r3QvCB+ifOBGzFd2S4PduttxHW+xldWknah8513u9mRNCwnSFbY9ZXTpSeDmJaPo
hYAZ2WlDodkaJxbTTMbJ+4fr6wMkmWf32g5pRh+wDfMAd0Wvbzmu/+fUQVf54FNU
Qb91AAtVBuIE0J8jKqZxw+dtno+e6etmO1pXoZXvPHUr2N2BJmI=
=yxgm
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-announce@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"
Hash: SHA512
=============================================================================
FreeBSD-SA-21:04.jail_remove Security Advisory
The FreeBSD Project
Topic: jail_remove(2) fails to kill all jailed processes
Category: core
Module: jail
Announced: 2021-02-24
Credits: Mateusz Guzik
Affects: All supported versions of FreeBSD.
Corrected: 2021-02-19 01:22:08 UTC (stable/13, 13.0-STABLE)
2021-02-19 21:53:07 UTC (releng/13.0, 13.0-BETA3-p1)
2021-02-19 21:46:31 UTC (stable/12, 12.2-STABLE)
2021-02-24 01:43:39 UTC (releng/12.2, 12.2-RELEASE-p4)
2021-02-19 21:50:26 UTC (stable/11, 11.4-STABLE)
2021-02-24 01:41:41 UTC (releng/11.4, 11.4-RELEASE-p8)
CVE Name: CVE-2020-25581
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.
I. Background
The jail(2) system call allows a system administrator to lock a process
and all of its descendants inside an environment with a very limited
ability to affect the system outside that environment, even for
processes with superuser privileges. It is an extension of, but
far more powerful than, the traditional UNIX chroot(2) system call.
The jail_remove(2) system call, which was introduced in FreeBSD 8.0,
allows a non-jailed process to remove a jail, which includes terminating
all the processes running in that jail.
II. Problem Description
Due to a race condition in the jail_remove(2) implementation, it may fail
to kill some of the processes.
III. Impact
A process running inside a jail can avoid being killed during jail termination.
If a jail is subsequently started with the same root path, a lingering jailed
process may be able to exploit the window during which a devfs filesystem is
mounted but the jail's devfs ruleset has not been applied, to access device
nodes which are ordinarily inaccessible. If the process is privileged, it may
be able to escape the jail and gain full access to the system.
IV. Workaround
The problem is limited to scenarios where a jail containing an untrusted,
privileged process is stopped, and a jail is subsequently started with the same
root path. Users not running jails are not affected, and the problem can be
avoided by not starting a jail with the same path as a previously stopped jail.
V. Solution
Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date and reboot.
Perform one of the following:
1) To update your vulnerable system via a binary patch:
Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
# shutdown -r +10min "Rebooting for a security update"
2) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
[FreeBSD 13.x]
# fetch https://security.FreeBSD.org/patches/SA-21:04/jail_remove.13.patch
# fetch https://security.FreeBSD.org/patches/SA-21:04/jail_remove.13.patch.asc
# gpg --verify jail_remove.13.patch.asc
[FreeBSD 11.x, FreeBSD 12.x]
# fetch https://security.FreeBSD.org/patches/SA-21:04/jail_remove.patch
# fetch https://security.FreeBSD.org/patches/SA-21:04/jail_remove.patch.asc
# gpg --verify jail_remove.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile your kernel as described in
<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
system.
VI. Correction details
The following list contains the correction revision numbers for each
affected branch.
Branch/path Revision
- -------------------------------------------------------------------------
stable/13/ 894360bacd42f021551f76518edd445f6d299f2e
releng/13.0/ 9f00cb5fa8a438e7b9efb2158f2e2edc730badd1
stable/12/ r369312
releng/12.2/ r369353
stable/11/ r369313
releng/11.4/ r369347
- -------------------------------------------------------------------------
[FreeBSD 13.x]
To see which files were modified by a particular revision, run the following
command in a checked out git repository, replacing NNNNNN with the revision
hash:
# git show --stat NNNNNN
Or visit the following URL, replace NNNNNN with the revision hash:
<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
[FreeBSD 11.x, FreeBSD 12.x]
To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
Or visit the following URL, replacing NNNNNN with the revision number:
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
VII. References
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25581>
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-21:04.jail_remove.asc>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAmA15dYACgkQ05eS9J6n
5cK69Q//UI2SeHrGXytm6ScQzCIbFPlUXlhkCX51WSOJmr/LUXpF9bcUhW73qqov
/c70VGF876woMXHkbfYnCVdB4ETLIqTbGOl2aw/c8fuwrmFdtyeDEQ4SRRfWgdC4
L6jEgMvB/fMO9e662k19f6RFXrdMspK4rOz3/aowTFbOEvD3Q0HpBUnFbWWg3Iiy
I190M0jbytFuZ2EJQ563bbRFFjEafZ51SKYz1FcR3cJAbVo/q75G3uDrjeNhnHxZ
0VqcTGHmF4Lh+RocUeW0v/1wHL8lBpoAKXmo4IL+FhFIR8fjVpKbGSm/IHSueatT
Tr6xOg93Ef+sETWVn9Jv26BAU06LEM/ZuXz+HS7T7DwnJJeKa3d74KTJnnGauE24
67OO0i4Fok9Yyy2ArBH8V8mnzdW96dJyHrwdG0UUBddYlEyzArxkUQZyoIdj1Gb1
fns8ndY8t5tky2fxHZG2UMBWwQKBtbMZY027JRylAJWExsG6wH7DcUJ51FpcnbNe
r3QvCB+ifOBGzFd2S4PduttxHW+xldWknah8513u9mRNCwnSFbY9ZXTpSeDmJaPo
hYAZ2WlDodkaJxbTTMbJ+4fr6wMkmWf32g5pRh+wDfMAd0Wvbzmu/+fUQVf54FNU
Qb91AAtVBuIE0J8jKqZxw+dtno+e6etmO1pXoZXvPHUr2N2BJmI=
=yxgm
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-announce@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"
[FreeBSD-Announce] FreeBSD Security Advisory FreeBSD-SA-21:06.xen
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
=============================================================================
FreeBSD-SA-21:06.xen Security Advisory
The FreeBSD Project
Topic: Xen grant mapping error handling issues
Category: contrib
Module: xen
Announced: 2021-02-24
Credits: See Xen XSA-361 for details
Affects: All supported versions of FreeBSD.
Corrected: 2021-02-23 00:55:14 UTC (stable/13, 13.0-STABLE)
2021-02-24 01:42:35 UTC (releng/13.0, 13.0-BETA3-p1)
2021-02-23 00:58:03 UTC (stable/12, 12.2-STABLE)
2021-02-24 01:43:59 UTC (releng/12.2, 12.2-RELEASE-p4)
2021-02-23 00:59:23 UTC (stable/11, 11.4-STABLE)
2021-02-24 01:41:51 UTC (releng/11.4, 11.4-RELEASE-p8)
CVE Name: CVE-2021-26932
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.
I. Background
Xen is a type-1 hypervisor which supports FreeBSD as a Dom0 (or host domain).
II. Problem Description
Grant mapping operations often occur in batch hypercalls, where a number of
operations are done in a single hypercall, the success or failure of each one
reported to the backend driver, and the backend driver then loops over the
results, performing follow-up actions based on the success or failure of each
operation.
Unfortunately, when running in HVM/PVH mode, the FreeBSD backend drivers
mishandle this: Some errors are ignored, effectively implying their success
from the success of related batch elements. In other cases, errors resulting
from one batch element lead to further batch elements not being inspected,
and hence successful ones to not be possible to properly unmap upon error
recovery.
III. Impact
A malicious or buggy frontend driver may be able to cause resource leaks
in the domain running the corresponding backend driver.
IV. Workaround
No workaround is available. FreeBSD systems not using Xen are not
affected.
V. Solution
Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date
and reboot.
Perform one of the following:
1) To update your vulnerable system via a binary patch:
Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
# shutdown -r +10min "Rebooting for a security update"
2) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch https://security.FreeBSD.org/patches/SA-21:06/xen.patch
# fetch https://security.FreeBSD.org/patches/SA-21:06/xen.patch.asc
# gpg --verify xen.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile your kernel as described in
<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
system.
VI. Correction details
The following list contains the correction revision numbers for each
affected branch.
Branch/path Revision
- -------------------------------------------------------------------------
stable/13/ ab3e1bd3c22a222520c23c2793cc39e3a23c9b46
releng/13.0/ ce9af53d0897a1cb926bd244f499fc09b1626b27
stable/12/ r369341
releng/12.2/ r369358
stable/11/ r369342
releng/11.4/ r369350
- -------------------------------------------------------------------------
[FreeBSD 13.x]
To see which files were modified by a particular revision, run the following
command in a checked out git repository, replacing NNNNNN with the revision
hash:
# git show --stat NNNNNN
Or visit the following URL, replace NNNNNN with the revision hash:
<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
[FreeBSD 11.x, FreeBSD 12.x]
To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
Or visit the following URL, replacing NNNNNN with the revision number:
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
VII. References
<URL:https://xenbits.xen.org/xsa/advisory-361.html>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26932>
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-21:06.xen.asc>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAmA15dcACgkQ05eS9J6n
5cKBJg//aACyR6yp/rs1MaAMj2QIm53y+s1/0qRQmAYTq7QVnMNhauGLIUdd7BPQ
O3Gj1fsdpg3iNpKXn20YweUpTQqt4xHxNg+A+cYxexHJ/mepVVnY4OMwWh2est17
2p9Sj3k0vNQ/AdYXELyKW7UA5/tHncFv6EGzdAsGYf4kGUL89bnmWkmcBLR9JZ9a
iF83WhKhLe3O7KzkryMzCh72nbHnKicjrgvun4VH4p5/FrjqNjoPESvGhT6hyObK
80aKN610j/ZdDNdjD0wO62IGB8QGzx/hpr3TIIQ05ydGsuurFKJQYwknYL7rbpuf
GaINHkQTcB+8aWsqSQxq3HTy3P7hEdA3HDzounpAOtYHk+Ff8ZeuH0ZVtJYXP6FP
lbFZoYzXak8odKZp5tNBO8Vu9qiuzthY/ImhZ0d5e+gQ5Bk2Nu68vwie2TGRpLEN
EQYIiIS1AnFsEhDx78UuEojUT/UmMIbv7GNyryv2ElThf1uIH86wtXonie8OFjPp
EGYu4OS/m+FO5fTcEty5ayEsQI0i4mnj83BBdq8sq2lpQbdJjKDSaykHfJ4PEMKi
/WRWiWjlS6fhu+rPC7rJ5b7FoDLXh6hm3uFuD/zNjOmpFFyjNE/O4JCH2zoAdH3C
ygVMUqa4qFalsC3vntk2YweBX4D7za95z4oCDwrFBm4ZWGYcwgs=
=fN2Q
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-announce@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"
Hash: SHA512
=============================================================================
FreeBSD-SA-21:06.xen Security Advisory
The FreeBSD Project
Topic: Xen grant mapping error handling issues
Category: contrib
Module: xen
Announced: 2021-02-24
Credits: See Xen XSA-361 for details
Affects: All supported versions of FreeBSD.
Corrected: 2021-02-23 00:55:14 UTC (stable/13, 13.0-STABLE)
2021-02-24 01:42:35 UTC (releng/13.0, 13.0-BETA3-p1)
2021-02-23 00:58:03 UTC (stable/12, 12.2-STABLE)
2021-02-24 01:43:59 UTC (releng/12.2, 12.2-RELEASE-p4)
2021-02-23 00:59:23 UTC (stable/11, 11.4-STABLE)
2021-02-24 01:41:51 UTC (releng/11.4, 11.4-RELEASE-p8)
CVE Name: CVE-2021-26932
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.
I. Background
Xen is a type-1 hypervisor which supports FreeBSD as a Dom0 (or host domain).
II. Problem Description
Grant mapping operations often occur in batch hypercalls, where a number of
operations are done in a single hypercall, the success or failure of each one
reported to the backend driver, and the backend driver then loops over the
results, performing follow-up actions based on the success or failure of each
operation.
Unfortunately, when running in HVM/PVH mode, the FreeBSD backend drivers
mishandle this: Some errors are ignored, effectively implying their success
from the success of related batch elements. In other cases, errors resulting
from one batch element lead to further batch elements not being inspected,
and hence successful ones to not be possible to properly unmap upon error
recovery.
III. Impact
A malicious or buggy frontend driver may be able to cause resource leaks
in the domain running the corresponding backend driver.
IV. Workaround
No workaround is available. FreeBSD systems not using Xen are not
affected.
V. Solution
Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date
and reboot.
Perform one of the following:
1) To update your vulnerable system via a binary patch:
Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
# shutdown -r +10min "Rebooting for a security update"
2) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch https://security.FreeBSD.org/patches/SA-21:06/xen.patch
# fetch https://security.FreeBSD.org/patches/SA-21:06/xen.patch.asc
# gpg --verify xen.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile your kernel as described in
<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
system.
VI. Correction details
The following list contains the correction revision numbers for each
affected branch.
Branch/path Revision
- -------------------------------------------------------------------------
stable/13/ ab3e1bd3c22a222520c23c2793cc39e3a23c9b46
releng/13.0/ ce9af53d0897a1cb926bd244f499fc09b1626b27
stable/12/ r369341
releng/12.2/ r369358
stable/11/ r369342
releng/11.4/ r369350
- -------------------------------------------------------------------------
[FreeBSD 13.x]
To see which files were modified by a particular revision, run the following
command in a checked out git repository, replacing NNNNNN with the revision
hash:
# git show --stat NNNNNN
Or visit the following URL, replace NNNNNN with the revision hash:
<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
[FreeBSD 11.x, FreeBSD 12.x]
To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
Or visit the following URL, replacing NNNNNN with the revision number:
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
VII. References
<URL:https://xenbits.xen.org/xsa/advisory-361.html>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26932>
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-21:06.xen.asc>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAmA15dcACgkQ05eS9J6n
5cKBJg//aACyR6yp/rs1MaAMj2QIm53y+s1/0qRQmAYTq7QVnMNhauGLIUdd7BPQ
O3Gj1fsdpg3iNpKXn20YweUpTQqt4xHxNg+A+cYxexHJ/mepVVnY4OMwWh2est17
2p9Sj3k0vNQ/AdYXELyKW7UA5/tHncFv6EGzdAsGYf4kGUL89bnmWkmcBLR9JZ9a
iF83WhKhLe3O7KzkryMzCh72nbHnKicjrgvun4VH4p5/FrjqNjoPESvGhT6hyObK
80aKN610j/ZdDNdjD0wO62IGB8QGzx/hpr3TIIQ05ydGsuurFKJQYwknYL7rbpuf
GaINHkQTcB+8aWsqSQxq3HTy3P7hEdA3HDzounpAOtYHk+Ff8ZeuH0ZVtJYXP6FP
lbFZoYzXak8odKZp5tNBO8Vu9qiuzthY/ImhZ0d5e+gQ5Bk2Nu68vwie2TGRpLEN
EQYIiIS1AnFsEhDx78UuEojUT/UmMIbv7GNyryv2ElThf1uIH86wtXonie8OFjPp
EGYu4OS/m+FO5fTcEty5ayEsQI0i4mnj83BBdq8sq2lpQbdJjKDSaykHfJ4PEMKi
/WRWiWjlS6fhu+rPC7rJ5b7FoDLXh6hm3uFuD/zNjOmpFFyjNE/O4JCH2zoAdH3C
ygVMUqa4qFalsC3vntk2YweBX4D7za95z4oCDwrFBm4ZWGYcwgs=
=fN2Q
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-announce@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"
[FreeBSD-Announce] FreeBSD Security Advisory FreeBSD-SA-21:05.jail_chdir
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
=============================================================================
FreeBSD-SA-21:05.jail_chdir Security Advisory
The FreeBSD Project
Topic: jail_attach(2) relies on the caller to change the cwd
Category: core
Module: jail
Announced: 2021-02-24
Credits: Mateusz Guzik
Affects: All supported versions of FreeBSD.
Corrected: 2021-02-22 05:49:40 UTC (stable/13, 13.0-STABLE)
2021-02-22 18:25:23 UTC (releng/13.0, 13.0-BETA3-p1)
2021-02-22 19:03:43 UTC (stable/12, 12.2-STABLE)
2021-02-24 01:43:47 UTC (releng/12.2, 12.2-RELEASE-p4)
2021-02-22 19:08:27 UTC (stable/11, 11.4-STABLE)
2021-02-24 01:41:46 UTC (releng/11.4, 11.4-RELEASE-p8)
CVE Name: CVE-2020-25582
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.
I. Background
The jail(2) system call allows a system administrator to lock a process
and all of its descendants inside an environment with a very limited
ability to affect the system outside that environment, even for
processes with superuser privileges. It is an extension of, but
far more powerful than, the traditional UNIX chroot(2) system call.
The jail_attach(2) system call, which was introduced in FreeBSD 5
before 5.1-RELEASE, allows a non-jailed process to permanently move
into an existing jail.
The ptrace(2) system call provides tracing and debugging facilities by
allowing one process (the tracing process) to watch and control
another (the traced process).
II. Problem Description
When a process, such as jexec(8) or killall(1), calls jail_attach(2)
to enter a jail, the jailed root can attach to it using ptrace(2) before
the current working directory is changed.
III. Impact
A process with superuser privileges running inside a jail could change
the root directory outside of the jail, thereby gaining full read and
writing access to all files and directories in the system.
IV. Workaround
No workaround is available, but systems that are not running jails with
untrusted root users are not vulnerable.
V. Solution
Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date
and reboot.
Perform one of the following:
1) To update your vulnerable system via a binary patch:
Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
# shutdown -r +10min "Rebooting for a security update"
2) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
[FreeBSD 13.x]
# fetch https://security.FreeBSD.org/patches/SA-21:05/jail_chdir.13.patch
# fetch https://security.FreeBSD.org/patches/SA-21:05/jail_chdir.13.patch.asc
# gpg --verify jail_chdir.13.patch.asc
[FreeBSD 11.x, FreeBSD 12.x]
# fetch https://security.FreeBSD.org/patches/SA-21:05/jail_chdir.patch
# fetch https://security.FreeBSD.org/patches/SA-21:05/jail_chdir.patch.asc
# gpg --verify jail_chdir.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile your kernel as described in
<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
system.
VI. Correction details
The following list contains the correction revision numbers for each
affected branch.
Branch/path Revision
- -------------------------------------------------------------------------
stable/13/ 5dbb407145c8128753fa30b695bc266dc671e433
releng/13.0/ f3f042d850baaeda1bed19e00c2b3b578644b7e9
stable/12/ r369334
releng/12.2/ r369354
stable/11/ r369335
releng/11.4/ r369348
- -------------------------------------------------------------------------
[FreeBSD 13.x]
To see which files were modified by a particular revision, run the following
command in a checked out git repository, replacing NNNNNN with the revision
hash:
# git show --stat NNNNNN
Or visit the following URL, replace NNNNNN with the revision hash:
<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
[FreeBSD 11.x, FreeBSD 12.x]
To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
Or visit the following URL, replacing NNNNNN with the revision number:
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
VII. References
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25582>
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-21:05.jail_chdir.asc>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAmA15dYACgkQ05eS9J6n
5cKj/xAAjbGc0bV3Ua8PuIFoDk7ADnwNotFV9PlXknWpeM4fXVVrt5EDncMfgHdw
XeKHOjzKNocOCtDioDhOcev9hhLeiYJjGHKrOQeKv34hJoufd6Wr0nvLgv/IVlMr
iZRVndvG1eBlnkwzlbx0xh1OY9zhffqjEiVkQNxXZV0iz/P2ndG0wP7N/bTG2QW3
1mZmp4Fh9AsbjLPVGyutoLZXiypuroGPLQZrth3n7Cz8HklwyPzoAgPOYx7mMW3D
x1Th6kYIEx1aCe+ZBsgOuPsKeZ4SSB5o1w2F5y+mor/rslgQJAppNakBMmyDkSEI
UhEqLGNA469P0qonCHhGY83wfkuUedFTuWLrdnh97J7yr+WIn1ik1/jBXxv3+1kS
bKivBd/oj6hEFULE7r6T/UVomJjU+dPPBm+ewljJFVib+3zIQsbxauLdqUuqWlob
QUkQc4mu7fjVSAMyVbYVrjBAgwQJit0KfX+JSbEcLndmPv1RCK8wnxIf0zbmV2m/
DMg9QGqwfcJkba6Y/JCAFZcl+HUCfEGUqZ7pEqGuwsp3wnMwO7Qg9IAEmDt8i2lf
6kaqAatJ5Reo/D+j6KJFvGCajnEfD0n+jDx8cdJFNY2Zzbo3/lRGd8dque5OEbTA
O0UZu2hRv5YMIagMf57WWzGrF+ACtgYbath710IKfVUfP/OiCIM=
=/d5L
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-announce@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"
Hash: SHA512
=============================================================================
FreeBSD-SA-21:05.jail_chdir Security Advisory
The FreeBSD Project
Topic: jail_attach(2) relies on the caller to change the cwd
Category: core
Module: jail
Announced: 2021-02-24
Credits: Mateusz Guzik
Affects: All supported versions of FreeBSD.
Corrected: 2021-02-22 05:49:40 UTC (stable/13, 13.0-STABLE)
2021-02-22 18:25:23 UTC (releng/13.0, 13.0-BETA3-p1)
2021-02-22 19:03:43 UTC (stable/12, 12.2-STABLE)
2021-02-24 01:43:47 UTC (releng/12.2, 12.2-RELEASE-p4)
2021-02-22 19:08:27 UTC (stable/11, 11.4-STABLE)
2021-02-24 01:41:46 UTC (releng/11.4, 11.4-RELEASE-p8)
CVE Name: CVE-2020-25582
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.
I. Background
The jail(2) system call allows a system administrator to lock a process
and all of its descendants inside an environment with a very limited
ability to affect the system outside that environment, even for
processes with superuser privileges. It is an extension of, but
far more powerful than, the traditional UNIX chroot(2) system call.
The jail_attach(2) system call, which was introduced in FreeBSD 5
before 5.1-RELEASE, allows a non-jailed process to permanently move
into an existing jail.
The ptrace(2) system call provides tracing and debugging facilities by
allowing one process (the tracing process) to watch and control
another (the traced process).
II. Problem Description
When a process, such as jexec(8) or killall(1), calls jail_attach(2)
to enter a jail, the jailed root can attach to it using ptrace(2) before
the current working directory is changed.
III. Impact
A process with superuser privileges running inside a jail could change
the root directory outside of the jail, thereby gaining full read and
writing access to all files and directories in the system.
IV. Workaround
No workaround is available, but systems that are not running jails with
untrusted root users are not vulnerable.
V. Solution
Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date
and reboot.
Perform one of the following:
1) To update your vulnerable system via a binary patch:
Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
# shutdown -r +10min "Rebooting for a security update"
2) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
[FreeBSD 13.x]
# fetch https://security.FreeBSD.org/patches/SA-21:05/jail_chdir.13.patch
# fetch https://security.FreeBSD.org/patches/SA-21:05/jail_chdir.13.patch.asc
# gpg --verify jail_chdir.13.patch.asc
[FreeBSD 11.x, FreeBSD 12.x]
# fetch https://security.FreeBSD.org/patches/SA-21:05/jail_chdir.patch
# fetch https://security.FreeBSD.org/patches/SA-21:05/jail_chdir.patch.asc
# gpg --verify jail_chdir.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile your kernel as described in
<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
system.
VI. Correction details
The following list contains the correction revision numbers for each
affected branch.
Branch/path Revision
- -------------------------------------------------------------------------
stable/13/ 5dbb407145c8128753fa30b695bc266dc671e433
releng/13.0/ f3f042d850baaeda1bed19e00c2b3b578644b7e9
stable/12/ r369334
releng/12.2/ r369354
stable/11/ r369335
releng/11.4/ r369348
- -------------------------------------------------------------------------
[FreeBSD 13.x]
To see which files were modified by a particular revision, run the following
command in a checked out git repository, replacing NNNNNN with the revision
hash:
# git show --stat NNNNNN
Or visit the following URL, replace NNNNNN with the revision hash:
<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
[FreeBSD 11.x, FreeBSD 12.x]
To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
Or visit the following URL, replacing NNNNNN with the revision number:
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
VII. References
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25582>
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-21:05.jail_chdir.asc>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAmA15dYACgkQ05eS9J6n
5cKj/xAAjbGc0bV3Ua8PuIFoDk7ADnwNotFV9PlXknWpeM4fXVVrt5EDncMfgHdw
XeKHOjzKNocOCtDioDhOcev9hhLeiYJjGHKrOQeKv34hJoufd6Wr0nvLgv/IVlMr
iZRVndvG1eBlnkwzlbx0xh1OY9zhffqjEiVkQNxXZV0iz/P2ndG0wP7N/bTG2QW3
1mZmp4Fh9AsbjLPVGyutoLZXiypuroGPLQZrth3n7Cz8HklwyPzoAgPOYx7mMW3D
x1Th6kYIEx1aCe+ZBsgOuPsKeZ4SSB5o1w2F5y+mor/rslgQJAppNakBMmyDkSEI
UhEqLGNA469P0qonCHhGY83wfkuUedFTuWLrdnh97J7yr+WIn1ik1/jBXxv3+1kS
bKivBd/oj6hEFULE7r6T/UVomJjU+dPPBm+ewljJFVib+3zIQsbxauLdqUuqWlob
QUkQc4mu7fjVSAMyVbYVrjBAgwQJit0KfX+JSbEcLndmPv1RCK8wnxIf0zbmV2m/
DMg9QGqwfcJkba6Y/JCAFZcl+HUCfEGUqZ7pEqGuwsp3wnMwO7Qg9IAEmDt8i2lf
6kaqAatJ5Reo/D+j6KJFvGCajnEfD0n+jDx8cdJFNY2Zzbo3/lRGd8dque5OEbTA
O0UZu2hRv5YMIagMf57WWzGrF+ACtgYbath710IKfVUfP/OiCIM=
=/d5L
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-announce@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"
[FreeBSD-Announce] FreeBSD Security Advisory FreeBSD-SA-21:03.pam_login_access
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
=============================================================================
FreeBSD-SA-21:03.pam_login_access Security Advisory
The FreeBSD Project
Topic: login.access fails to apply rules
Category: core
Module: pam_login_access
Announced: 2021-02-24
Affects: All supported versions of FreeBSD.
Corrected: 2021-02-24 01:20:53 UTC (stable/13, 13.0-STABLE)
2021-02-24 01:42:42 UTC (releng/13.0, 13.0-BETA3-p1)
2021-02-24 01:40:36 UTC (stable/12, 12.2-STABLE)
2021-02-24 01:44:01 UTC (releng/12.2, 12.2-RELEASE-p4)
2021-02-24 01:39:53 UTC (stable/11, 11.4-STABLE)
2021-02-24 01:41:53 UTC (releng/11.4, 11.4-RELEASE-p8)
CVE Name: CVE-2020-25580
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.
I. Background
login.access(5) is a system configuration file allowing administrators to
define policy around system login access by specific users and groups. It
is implemented by a pam(3) module, pam_login_access(8), and is configured
by default for accesses via sshd(8), telnetd(8) and the system console.
II. Problem Description
A regression in the login.access(5) rule processor has the effect of causing
rules to fail to match even when they should not. This means that rules
denying access may be ignored.
III. Impact
The configuration in login.access(5) may not be applied, permitting login
access to users even when the system is configured to deny it.
IV. Workaround
No workaround is available. Systems not relying on login.access(5) to
enforce custom login policies are not affected.
V. Solution
Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date.
Perform one of the following:
1) To update your vulnerable system via a binary patch:
Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
2) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch https://security.FreeBSD.org/patches/SA-21:03/pam_login_access.patch
# fetch https://security.FreeBSD.org/patches/SA-21:03/pam_login_access.patch.asc
# gpg --verify pam_login_access.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile the operating system using buildworld and installworld as
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
Restart all daemons that use the library, or reboot the system.
VI. Correction details
The following list contains the correction revision numbers for each
affected branch.
Branch/path Revision
- -------------------------------------------------------------------------
stable/13/ 8cf559d6b9b4782bf67eb868ea480f47fc8c64a4
releng/13.0/ f82cffcf2f44c909bec00d18549826f5d1d62205
stable/12/ r369346
releng/12.2/ r369359
stable/11/ r369345
releng/11.4/ r369351
- -------------------------------------------------------------------------
[FreeBSD 13.x]
To see which files were modified by a particular revision, run the following
command in a checked out git repository, replacing NNNNNN with the revision
hash:
# git show --stat NNNNNN
Or visit the following URL, replace NNNNNN with the revision hash:
<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
[FreeBSD 11.x, FreeBSD 12.x]
To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
Or visit the following URL, replacing NNNNNN with the revision number:
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
VII. References
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25580>
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-21:03.pam_login_access.asc>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAmA15dYACgkQ05eS9J6n
5cKg1A/+MKN4Gf9ndHqjEUKiquiUGAE63RJC3wZRpN/GsxP2qLArX4QDOXLJxFZ3
+T+u3lb0vxhhowvp23vFegmQbmWA6ZHI4M+NBsgMnPLTEWkwy4tRTfZDma1Q9j3k
RNPJFnzJ5HTKBXtZom/yKcxuXw1JGlqmxuJYfveBEBIN6PmH5nz3qwcRVV8j+gAM
1CtmnWpUVHm8aOqEGhOPr/eNRbAX14S/rdrtETmyyKm7WlYtiFD8GN5Px+eTTZcM
khZhyhlpvEPU0tLNahnDGiPBmlr8VpysT0+0ZdGsT6qMME8WQne3pvJeM2HaZs8a
ob35quA5tH241NjNBvoYmMj50/UOFS8RZKb6VILX7+PVsYOiuoGKR8ikr6n09SZs
LYThBcnWx5Bwcn08DXbd2bPn48aSFnbe0UMTzwrTC0L/5lp2FLv9j+bhwb3gF6W1
9hmRHOb+Cvdxxqw/djFCQsxODC9qZzneRW012PTsEZcwB8UjvG+OEVahz5iOfiGC
tXNQ6rdbdTEr7QY+JCx0ngyHkQyDrOEJGd8UTIavr0CiuSdSWzi2zrppqZzvjBIp
MENgB7uWf0MvzkYbxqwlRFr+25MLPGPYNfcLR/NnoWZcEuXR9VUL9Nb+ozH1HGs2
oziYLqXp3yvDGrHXdItOz5sVsgsZCZLLVD4SVI7Y31Ctxd6MlcM=
=WQ8j
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-announce@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"
Hash: SHA512
=============================================================================
FreeBSD-SA-21:03.pam_login_access Security Advisory
The FreeBSD Project
Topic: login.access fails to apply rules
Category: core
Module: pam_login_access
Announced: 2021-02-24
Affects: All supported versions of FreeBSD.
Corrected: 2021-02-24 01:20:53 UTC (stable/13, 13.0-STABLE)
2021-02-24 01:42:42 UTC (releng/13.0, 13.0-BETA3-p1)
2021-02-24 01:40:36 UTC (stable/12, 12.2-STABLE)
2021-02-24 01:44:01 UTC (releng/12.2, 12.2-RELEASE-p4)
2021-02-24 01:39:53 UTC (stable/11, 11.4-STABLE)
2021-02-24 01:41:53 UTC (releng/11.4, 11.4-RELEASE-p8)
CVE Name: CVE-2020-25580
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.
I. Background
login.access(5) is a system configuration file allowing administrators to
define policy around system login access by specific users and groups. It
is implemented by a pam(3) module, pam_login_access(8), and is configured
by default for accesses via sshd(8), telnetd(8) and the system console.
II. Problem Description
A regression in the login.access(5) rule processor has the effect of causing
rules to fail to match even when they should not. This means that rules
denying access may be ignored.
III. Impact
The configuration in login.access(5) may not be applied, permitting login
access to users even when the system is configured to deny it.
IV. Workaround
No workaround is available. Systems not relying on login.access(5) to
enforce custom login policies are not affected.
V. Solution
Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date.
Perform one of the following:
1) To update your vulnerable system via a binary patch:
Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
2) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch https://security.FreeBSD.org/patches/SA-21:03/pam_login_access.patch
# fetch https://security.FreeBSD.org/patches/SA-21:03/pam_login_access.patch.asc
# gpg --verify pam_login_access.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile the operating system using buildworld and installworld as
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
Restart all daemons that use the library, or reboot the system.
VI. Correction details
The following list contains the correction revision numbers for each
affected branch.
Branch/path Revision
- -------------------------------------------------------------------------
stable/13/ 8cf559d6b9b4782bf67eb868ea480f47fc8c64a4
releng/13.0/ f82cffcf2f44c909bec00d18549826f5d1d62205
stable/12/ r369346
releng/12.2/ r369359
stable/11/ r369345
releng/11.4/ r369351
- -------------------------------------------------------------------------
[FreeBSD 13.x]
To see which files were modified by a particular revision, run the following
command in a checked out git repository, replacing NNNNNN with the revision
hash:
# git show --stat NNNNNN
Or visit the following URL, replace NNNNNN with the revision hash:
<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
[FreeBSD 11.x, FreeBSD 12.x]
To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
Or visit the following URL, replacing NNNNNN with the revision number:
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
VII. References
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25580>
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-21:03.pam_login_access.asc>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAmA15dYACgkQ05eS9J6n
5cKg1A/+MKN4Gf9ndHqjEUKiquiUGAE63RJC3wZRpN/GsxP2qLArX4QDOXLJxFZ3
+T+u3lb0vxhhowvp23vFegmQbmWA6ZHI4M+NBsgMnPLTEWkwy4tRTfZDma1Q9j3k
RNPJFnzJ5HTKBXtZom/yKcxuXw1JGlqmxuJYfveBEBIN6PmH5nz3qwcRVV8j+gAM
1CtmnWpUVHm8aOqEGhOPr/eNRbAX14S/rdrtETmyyKm7WlYtiFD8GN5Px+eTTZcM
khZhyhlpvEPU0tLNahnDGiPBmlr8VpysT0+0ZdGsT6qMME8WQne3pvJeM2HaZs8a
ob35quA5tH241NjNBvoYmMj50/UOFS8RZKb6VILX7+PVsYOiuoGKR8ikr6n09SZs
LYThBcnWx5Bwcn08DXbd2bPn48aSFnbe0UMTzwrTC0L/5lp2FLv9j+bhwb3gF6W1
9hmRHOb+Cvdxxqw/djFCQsxODC9qZzneRW012PTsEZcwB8UjvG+OEVahz5iOfiGC
tXNQ6rdbdTEr7QY+JCx0ngyHkQyDrOEJGd8UTIavr0CiuSdSWzi2zrppqZzvjBIp
MENgB7uWf0MvzkYbxqwlRFr+25MLPGPYNfcLR/NnoWZcEuXR9VUL9Nb+ozH1HGs2
oziYLqXp3yvDGrHXdItOz5sVsgsZCZLLVD4SVI7Y31Ctxd6MlcM=
=WQ8j
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-announce@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"
[FreeBSD-Announce] FreeBSD Errata Notice FreeBSD-EN-21:08.freebsd-update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
=============================================================================
FreeBSD-EN-21:08.freebsd-update Errata Notice
The FreeBSD Project
Topic: freebsd-update passwd regeneration
Category: core
Module: freebsd-update
Announced: 2021-02-24
Affects: All supported versions of FreeBSD.
Corrected: 2020-12-27 20:50:53 UTC (stable/12, 12.2-STABLE)
2021-02-24 01:43:52 UTC (releng/12.2, 12.2-RELEASE-p4)
2020-12-27 20:52:37 UTC (stable/11, 11.4-STABLE)
2021-02-24 01:41:49 UTC (releng/11.4, 11.4-RELEASE-p8)
For general information regarding FreeBSD Errata Notices and Security
Advisories, including descriptions of the fields above, security
branches, and the following sections, please visit
<URL:https://security.FreeBSD.org/>.
I. Background
freebsd-update provides binary updates for supported releases of FreeBSD on
amd64 and i386.
II. Problem Description
The existing logic to try and avoid regenerating passwd/login.conf files
relies on timestamp comparisons between old and new files, with the caveat
that it's comparing the installed with a timestamp that has been clobbered to
do the comparison.
III. Impact
User and login.conf changes coming in from a binary update may not properly
regenerate the databases for the changes to take effect.
IV. Workaround
To workaround this issue, one may regenerate databases manually with
pwd_mkdb(8) and cap_mkdb(1), e.g.,
pwd_mkdb -p /etc/master.passwd
cap_mkdb /etc/login.conf
V. Solution
Upgrade your system to a supported FreeBSD stable or release / security
branch (releng) dated after the correction date. No reboot is required.
Perform one of the following:
1) To update your system via a binary patch:
Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
2) To update your system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch https://security.FreeBSD.org/patches/EN-21:08/freebsd-update.patch
# fetch https://security.FreeBSD.org/patches/EN-21:08/freebsd-update.patch.asc
# gpg --verify freebsd-update.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile the operating system using buildworld and installworld as
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
VI. Correction details
The following list contains the correction revision numbers for each
affected branch.
Branch/path Revision
- -------------------------------------------------------------------------
stable/12/ r368873
releng/12.2/ r369356
stable/11/ r368824
releng/11.4/ r369349
- -------------------------------------------------------------------------
To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
Or visit the following URL, replacing NNNNNN with the revision number:
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
VII. References
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-21:08.freebsd-update.asc>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAmA15cgACgkQ05eS9J6n
5cJRqA/+NMSpCafAMdn0T3ZFbZ+AwN3nHS5t/2UBBRnpUks0CWXR1XnZ7CqeTZUc
vCy3+QR93bQYDVCW7tNCOVs0bL7dVyyT9qLrmaJC1LFBtMAaM091A3gXdlhaL5I9
mATPs/Qy3/HFDjeWWZDNeg0RsXhzEnM3I/FPhhWYkA/iO++5Og1VuBWFpuPGUZbG
VuRRVuazHzqVKjlQL7XUKHJk2PGJIXTBAZHQkBn4cwux9iDxjhowtvN3hMJSPTPI
GAu3YD1YrM7UIyguh3WieVOVuHtwUdj+mccw3iifn02crq93H2Wyj4nDDYaUQXz5
Ab9HjuVGE/VjPMgfqRtouQieGTJIMCo8Y/4ytPe+Dhvtxrd4LYBHuYhZFfMFTITC
lAXUhtdF5l/PJWNG24BE3BWjPEgU3vwTtuL56PHcpO08lKgwzidvOtPV2hM2mbw/
RRJWZ0AYe8q624NwpC96WUvW5DoBA2thBXxmUaQ4KBK06tiSg/jXzmG9em4WfaQH
z2aAeg+MURBaecTfl1gWZFdkOOwNcn089T/XhLh2FuzX4NGIQChvo1gEj7thsXQp
jWF+HUpxfZ9ZZIRuNCdAjCCAY2R3pkAZSGAUvi7TTqZfbPQtAb0SgT6QXj6OslCG
w4puBrBQl+R3g3dN1Q9NSDqmob1g8MrN7mUv8Nl7LFNpnWDh4Bs=
=C5YV
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-announce@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"
Hash: SHA512
=============================================================================
FreeBSD-EN-21:08.freebsd-update Errata Notice
The FreeBSD Project
Topic: freebsd-update passwd regeneration
Category: core
Module: freebsd-update
Announced: 2021-02-24
Affects: All supported versions of FreeBSD.
Corrected: 2020-12-27 20:50:53 UTC (stable/12, 12.2-STABLE)
2021-02-24 01:43:52 UTC (releng/12.2, 12.2-RELEASE-p4)
2020-12-27 20:52:37 UTC (stable/11, 11.4-STABLE)
2021-02-24 01:41:49 UTC (releng/11.4, 11.4-RELEASE-p8)
For general information regarding FreeBSD Errata Notices and Security
Advisories, including descriptions of the fields above, security
branches, and the following sections, please visit
<URL:https://security.FreeBSD.org/>.
I. Background
freebsd-update provides binary updates for supported releases of FreeBSD on
amd64 and i386.
II. Problem Description
The existing logic to try and avoid regenerating passwd/login.conf files
relies on timestamp comparisons between old and new files, with the caveat
that it's comparing the installed with a timestamp that has been clobbered to
do the comparison.
III. Impact
User and login.conf changes coming in from a binary update may not properly
regenerate the databases for the changes to take effect.
IV. Workaround
To workaround this issue, one may regenerate databases manually with
pwd_mkdb(8) and cap_mkdb(1), e.g.,
pwd_mkdb -p /etc/master.passwd
cap_mkdb /etc/login.conf
V. Solution
Upgrade your system to a supported FreeBSD stable or release / security
branch (releng) dated after the correction date. No reboot is required.
Perform one of the following:
1) To update your system via a binary patch:
Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
2) To update your system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch https://security.FreeBSD.org/patches/EN-21:08/freebsd-update.patch
# fetch https://security.FreeBSD.org/patches/EN-21:08/freebsd-update.patch.asc
# gpg --verify freebsd-update.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile the operating system using buildworld and installworld as
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
VI. Correction details
The following list contains the correction revision numbers for each
affected branch.
Branch/path Revision
- -------------------------------------------------------------------------
stable/12/ r368873
releng/12.2/ r369356
stable/11/ r368824
releng/11.4/ r369349
- -------------------------------------------------------------------------
To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
Or visit the following URL, replacing NNNNNN with the revision number:
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
VII. References
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-21:08.freebsd-update.asc>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAmA15cgACgkQ05eS9J6n
5cJRqA/+NMSpCafAMdn0T3ZFbZ+AwN3nHS5t/2UBBRnpUks0CWXR1XnZ7CqeTZUc
vCy3+QR93bQYDVCW7tNCOVs0bL7dVyyT9qLrmaJC1LFBtMAaM091A3gXdlhaL5I9
mATPs/Qy3/HFDjeWWZDNeg0RsXhzEnM3I/FPhhWYkA/iO++5Og1VuBWFpuPGUZbG
VuRRVuazHzqVKjlQL7XUKHJk2PGJIXTBAZHQkBn4cwux9iDxjhowtvN3hMJSPTPI
GAu3YD1YrM7UIyguh3WieVOVuHtwUdj+mccw3iifn02crq93H2Wyj4nDDYaUQXz5
Ab9HjuVGE/VjPMgfqRtouQieGTJIMCo8Y/4ytPe+Dhvtxrd4LYBHuYhZFfMFTITC
lAXUhtdF5l/PJWNG24BE3BWjPEgU3vwTtuL56PHcpO08lKgwzidvOtPV2hM2mbw/
RRJWZ0AYe8q624NwpC96WUvW5DoBA2thBXxmUaQ4KBK06tiSg/jXzmG9em4WfaQH
z2aAeg+MURBaecTfl1gWZFdkOOwNcn089T/XhLh2FuzX4NGIQChvo1gEj7thsXQp
jWF+HUpxfZ9ZZIRuNCdAjCCAY2R3pkAZSGAUvi7TTqZfbPQtAb0SgT6QXj6OslCG
w4puBrBQl+R3g3dN1Q9NSDqmob1g8MrN7mUv8Nl7LFNpnWDh4Bs=
=C5YV
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-announce@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"
[FreeBSD-Announce] FreeBSD Errata Notice FreeBSD-EN-21:07.caroot
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
=============================================================================
FreeBSD-EN-21:07.caroot Errata Notice
The FreeBSD Project
Topic: Root certificate bundle update
Category: core
Module: caroot
Announced: 2021-02-24
Affects: FreeBSD 12.2
Corrected: 2020-12-15 21:50:05 UTC (stable/12, 12.2-STABLE)
2021-02-24 01:43:56 UTC (releng/12.2, 12.2-RELEASE-p4)
For general information regarding FreeBSD Errata Notices and Security
Advisories, including descriptions of the fields above, security
branches, and the following sections, please visit
<URL:https://security.FreeBSD.org/>.
I. Background
The root certificate bundle is the trust store that is used by OpenSSL
programs and libraries to aide in determining whether it should trust
a given SSL certificate.
II. Problem Description
Several certificates were removed from the bundle after the latest release
of FreeBSD 12.2.
III. Impact
Certificates are often removed from the root bundle due to a failure to
meet the standards established by Mozilla for being considered a trusted
Certificate Authority.
IV. Workaround
No workaround is available. Software that uses an internal trust store
is not affected.
V. Solution
Upgrade your system to a supported FreeBSD stable or release / security
branch (releng) dated after the correction date.
Perform one of the following:
1) To update your system via a binary patch:
Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
2) To update your system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch https://security.FreeBSD.org/patches/EN-21:07/caroot.patch
# fetch https://security.FreeBSD.org/patches/EN-21:07/caroot.patch.asc
# gpg --verify caroot.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile the operating system using buildworld and installworld as
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
Restart all applications that may be using OpenSSL, or reboot the system.
VI. Correction details
The following list contains the correction revision numbers for each
affected branch.
Branch/path Revision
- -------------------------------------------------------------------------
stable/12/ r368678
releng/12.2/ r369357
- -------------------------------------------------------------------------
To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
Or visit the following URL, replacing NNNNNN with the revision number:
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
VII. References
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-21:07.caroot.asc>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAmA15ccACgkQ05eS9J6n
5cJUlRAAnoqim9czLfJS8ooYVSmB2Q3Td+vg+/QrS1ftwGBI3hXAwzFtlsCn4P35
7k5tJQL3sVv3/nFfJ6/S5T832tVAfBgxFyzbu1C8zP2fYDLJ7uKKCtluoaHchB1y
KMOE11SPfdPtG0WeWUI1QEqCAhy91mZo1+B4zTMNazZ2AdLs7YSaovrBeYMcAR+K
xSGxvRndtX+4BvtGpehO3F+JMYsjpA06W3HP1gCsg9JnKo1whzrth83ar4V0aONS
Gcl90oyOy4IGHYPDm3vYahtKXmsO8FI3IpuuNDdkeL1KPbrUaCOvmnnTZWS9pAoT
S0DxUtHqfNz+iRuTLRO0/RIaopLADqx0fmDaRqGPy3MFUp1hevRCpPn8o5rtsjEK
hpsaWhhxrD3edGdu459JvM5cMT9Xr9/QxCneeJF96lgDP17IrB57RmNGu048ARbQ
Myb4G5+ypjnQJ4Y4ctGGlIJQcjfI7dVpSRXdj+qTLBdh2BCeL3d4UC267AgGA3mz
uspX/AxIcdHAvsiHGicbhV+tSw0LY1zPLCP9fgWcfDw8jyzY+Jrtj+B4TBsmTStu
qUpbq6WU7SJ4b7inV0RDmugyDAPFwROuc0u8+VSwI7Kt4VuzAPeSgvcythS88/47
huwCdkRE5Gh6RFy+gTg0tSyv5znQarif6E6pmETSnB8Cr4IbaBk=
=LVRY
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-announce@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"
Hash: SHA512
=============================================================================
FreeBSD-EN-21:07.caroot Errata Notice
The FreeBSD Project
Topic: Root certificate bundle update
Category: core
Module: caroot
Announced: 2021-02-24
Affects: FreeBSD 12.2
Corrected: 2020-12-15 21:50:05 UTC (stable/12, 12.2-STABLE)
2021-02-24 01:43:56 UTC (releng/12.2, 12.2-RELEASE-p4)
For general information regarding FreeBSD Errata Notices and Security
Advisories, including descriptions of the fields above, security
branches, and the following sections, please visit
<URL:https://security.FreeBSD.org/>.
I. Background
The root certificate bundle is the trust store that is used by OpenSSL
programs and libraries to aide in determining whether it should trust
a given SSL certificate.
II. Problem Description
Several certificates were removed from the bundle after the latest release
of FreeBSD 12.2.
III. Impact
Certificates are often removed from the root bundle due to a failure to
meet the standards established by Mozilla for being considered a trusted
Certificate Authority.
IV. Workaround
No workaround is available. Software that uses an internal trust store
is not affected.
V. Solution
Upgrade your system to a supported FreeBSD stable or release / security
branch (releng) dated after the correction date.
Perform one of the following:
1) To update your system via a binary patch:
Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
2) To update your system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch https://security.FreeBSD.org/patches/EN-21:07/caroot.patch
# fetch https://security.FreeBSD.org/patches/EN-21:07/caroot.patch.asc
# gpg --verify caroot.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile the operating system using buildworld and installworld as
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
Restart all applications that may be using OpenSSL, or reboot the system.
VI. Correction details
The following list contains the correction revision numbers for each
affected branch.
Branch/path Revision
- -------------------------------------------------------------------------
stable/12/ r368678
releng/12.2/ r369357
- -------------------------------------------------------------------------
To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
Or visit the following URL, replacing NNNNNN with the revision number:
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
VII. References
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-21:07.caroot.asc>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAmA15ccACgkQ05eS9J6n
5cJUlRAAnoqim9czLfJS8ooYVSmB2Q3Td+vg+/QrS1ftwGBI3hXAwzFtlsCn4P35
7k5tJQL3sVv3/nFfJ6/S5T832tVAfBgxFyzbu1C8zP2fYDLJ7uKKCtluoaHchB1y
KMOE11SPfdPtG0WeWUI1QEqCAhy91mZo1+B4zTMNazZ2AdLs7YSaovrBeYMcAR+K
xSGxvRndtX+4BvtGpehO3F+JMYsjpA06W3HP1gCsg9JnKo1whzrth83ar4V0aONS
Gcl90oyOy4IGHYPDm3vYahtKXmsO8FI3IpuuNDdkeL1KPbrUaCOvmnnTZWS9pAoT
S0DxUtHqfNz+iRuTLRO0/RIaopLADqx0fmDaRqGPy3MFUp1hevRCpPn8o5rtsjEK
hpsaWhhxrD3edGdu459JvM5cMT9Xr9/QxCneeJF96lgDP17IrB57RmNGu048ARbQ
Myb4G5+ypjnQJ4Y4ctGGlIJQcjfI7dVpSRXdj+qTLBdh2BCeL3d4UC267AgGA3mz
uspX/AxIcdHAvsiHGicbhV+tSw0LY1zPLCP9fgWcfDw8jyzY+Jrtj+B4TBsmTStu
qUpbq6WU7SJ4b7inV0RDmugyDAPFwROuc0u8+VSwI7Kt4VuzAPeSgvcythS88/47
huwCdkRE5Gh6RFy+gTg0tSyv5znQarif6E6pmETSnB8Cr4IbaBk=
=LVRY
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-announce@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"
Subscribe to:
Posts (Atom)