daily CVS update output
Updating src tree: P src/distrib/sets/lists/base/shl.mi P src/distrib/sets/lists/comp/mi P src/distrib/sets/lists/comp/shl.mi P src/distrib/sets/lists/debug/mi P src/distrib/sets/lists/debug/shl.mi P src/distrib/sets/lists/tests/mi P src/etc/mtree/NetBSD.dist.tests P src/external/gpl3/gcc/dist/gcc/ginclude/stddef.h P src/external/mit/xorg/server/xorg-server/hw/xfree86/glamor_egl/Makefile P src/lib/libedit/tty.c P src/sys/altq/altq_cbq.c P src/sys/arch/alpha/conf/std.alpha P src/sys/arch/alpha/jensenio/jensenio_intr.c P src/sys/arch/alpha/pci/sio_pic.c P src/sys/arch/cobalt/conf/std.cobalt P src/sys/arch/pmax/conf/std.pmax P src/sys/arch/pmax/conf/std.pmax64 P src/sys/arch/shark/conf/std.ofwgencfg P src/sys/arch/shark/conf/std.shark P src/sys/dev/usb/uchcom.c P src/sys/net/bpf.c P src/sys/net/if_vlan.c P src/sys/rump/include/opt/opt_rumpkernel.h P src/sys/rump/librump/rumpnet/net_stub.c P src/sys/rump/net/Makefile.rumpnetcomp U src/sys/rump/net/lib/libaltq/Makefile U src/sys/rump/net/lib/libaltq/altq_component.c P src/sys/rump/net/lib/libshmif/if_shmem.c P src/sys/ufs/ffs/ffs_vnops.c P src/tests/net/Makefile U src/tests/net/altq/Makefile U src/tests/net/altq/t_cbq.sh P src/tests/net/if_vlan/t_vlan.sh P src/tests/usr.bin/xlint/lint1/Makefile P src/tests/usr.bin/xlint/lint1/decl.c P src/tests/usr.bin/xlint/lint1/decl.exp P src/tests/usr.bin/xlint/lint1/decl_struct_member.c U src/tests/usr.bin/xlint/lint1/decl_struct_member.exp P src/tests/usr.bin/xlint/lint1/gcc_attribute_func.c U src/tests/usr.bin/xlint/lint1/gcc_attribute_func.exp U src/tests/usr.bin/xlint/lint1/gcc_stmt_asm.c U src/tests/usr.bin/xlint/lint1/gcc_stmt_asm.exp P src/tests/usr.bin/xlint/lint1/init_c90.c P src/tests/usr.bin/xlint/lint1/init_c90.exp P src/tests/usr.bin/xlint/lint1/msg_002.c P src/tests/usr.bin/xlint/lint1/msg_002.exp P src/tests/usr.bin/xlint/lint1/msg_072.c P src/tests/usr.bin/xlint/lint1/msg_072.exp U src/tests/usr.bin/xlint/lint1/stmt_goto.c U src/tests/usr.bin/xlint/lint1/stmt_goto.exp P src/usr.bin/xlint/lint1/cgram.y P src/usr.bin/xlint/lint1/externs1.h P src/usr.bin/xlint/lint1/tree.c P src/usr.sbin/altq/altqd/altq.conf.5 P src/usr.sbin/altq/libaltq/parser.c P src/usr.sbin/altq/libaltq/qop_cbq.c P src/usr.sbin/altq/libaltq/qop_cbq.h P src/usr.sbin/npf/npfctl/npfctl.c P src/usr.sbin/sysinst/disks.c Updating xsrc tree: Killing core files: Updating file list: -rw-rw-r-- 1 srcmastr netbsd 42766542 Jul 15 03:03 ls-lRA.gz
NetBSD Security Advisory 2021-002: Incorrect permissions in kernfs
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 NetBSD Security Advisory 2021-002 = Topic: Incorrect permissions in kernfs Version:NetBSD-current: affected between March 3, 2020 and July 6, 2021 NetBSD 9.2: affected NetBSD 9.1: affected NetBSD 9.0: affected NetBSD 8.*: not affected Severity: Local user may read any file on the root volume Fixed: NetBSD-current: July 6, 2021 NetBSD-9 branch:July 6, 2021 Please note that NetBSD releases prior to 8.0 are no longer supported. It is recommended that all users upgrade to a supported release. Abstract The /kern file system contains references to the device the root volume was mounted from. It was discovered that the permissions were incorrect and allow any local user to read the device, thus allowing any local user to read any file on the root volume. Technical Details = The files /kern/rootdev and /kern/rrootdev are internally-generated device special files that refer to the device the root volume was mounted from. Until July 6, 2021 they were presented as mode 444 (readable to all users). Prior to February 3, 2020 (February 12 on the NetBSD-9 branch, then at 9.0_RC2) this was harmless because these device special files did not actually work; however, that problem was corrected without noticing that the permissions were unsafe. Solutions and Workarounds = Immediate workaround: unmount /kern and mark it "noauto" in /etc/fstab. This will work (without impacting system functionality) for all systems other than Xen DOM0. Unfortunately Xen requires access to other elements in kernfs. Note that while chmod on the offending files appears to succeed, it does not take and is not an adequate workaround. To fix the underlying problem, update the kernel. To apply a fixed version from a releng build, fetch a fitting kern-GENERIC.tar.xz, kern-GENERIC_KASLR.tar.xz, kern-XEN3_DOM0.tar.xz, or kern-XEN3_DOMU.tar.xz (depending on which kernel you are using; uname -v will show, among other things, the name of the running kernel) from nycdn.NetBSD.org and extract the fixed binaries: cd /var/tmp ftp https://nycdn.NetBSD.org/pub/NetBSD-daily/REL/BUILD/ARCH/binary/sets/kern-GENERIC.tar.xz (or whichever) cd / tar xzpf /var/tmp/kern-GENERIC.tar.xz with the following replacements: REL = the release version you are using BUILD = the source date of the build. 202107060400Z and later will fit ARCH = your system's architecture The following instructions describe how to upgrade your kernel by updating your source tree and rebuilding and installing a new version. For affected NetBSD versions, you need to obtain fixed kernel sources, rebuild and install the new kernel, and reboot the system. The fixed source may be obtained from the NetBSD CVS repository. The following instructions briefly summarise how to upgrade your kernel. In these instructions, replace: ARCH with your architecture (from uname -m), and KERNCONF with the name of your kernel configuration file. To update from CVS, re-build, and re-install the kernel: # cd src # cvs update -d -P sys/miscfs/kernfs/kernfs_vnops.c # ./build.sh kernel=KERNCONF # mv /netbsd /netbsd.old # cp sys/arch/ARCH/compile/obj/KERNCONF/netbsd /netbsd # shutdown -r now For more information on how to do this, see: http://www.NetBSD.org/guide/en/chap-kernel.html Thanks To = David A. Holland Martin Husemann Jonathan A. Kollasch Jared McNeill Revision History 2021-07-14 Initial release More Information Advisories may be updated as new information becomes available. The most recent version of this advisory (PGP signed) can be found at http://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2021-NNN.txt.asc Information about NetBSD and NetBSD security can be found at http://www.NetBSD.org/ and http://www.NetBSD.org/Security/. Copyright 2021, The NetBSD Foundation, Inc. All Rights Reserved. Redistribution permitted only in full, unmodified form. $NetBSD: NetBSD-SA2021-002.txt,v 1.1 2021/07/14 17:48:26 christos Exp $ -BEGIN PGP SIGNATURE- iQIcBAEBAgAGBQJg7yNrAAoJEIkmHhf170n/MNwP/iD+dkuOVX5GVL+eSiCyCBAa kHZbyg8jMNTJB636b8/gwDl7Jf0x8K+B/2jAeO2wrYwBzSPtlpI4K/6cQrjQ8Yc8 DasPy2x0qmaWZc744/2MlVieStD0bNHS6uw+Fm+MFPeNtecVNg94Qsbs7tzqK1dw PueRPkRSafBkdmlffrmKNDASUZv2fUgOPL360Up8vIyfa3V1OAoCrJ18pIFjjiso rHzPXlLhc+DonvNwxzsk3JbGpkyC8URUhJ7r666Z2w2TWWfKOnJFhJvR2uw+yN1K v+2r1o+QpZMKw2xj4vvep+aefWxvyxmIBTgq/6vfiSOEx6TUFru6hgP11U+wnvBi lTdAWs9KNshE5/7yM60QrT9b72hPe1RvQn3CEn/ojVn9Xc3e9rWQaC/PV/ZqjxBl
NetBSD Security Advisory 2021-001: Predictable ID disclosures in IPv4 and IPv6
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 NetBSD Security Advisory 2021-001 = Topic: Predictable ID disclosures in IPv4 and IPv6 Version:NetBSD-current: affected NetBSD 9.1: affected NetBSD 8.2: affected Severity: Possible data exfiltration from firewalled or NATed networks Fixed: NetBSD-current: March 9, 2021 NetBSD-9 branch:March 9, 2021 NetBSD-8 branch:March 9, 2021 Please note that NetBSD releases prior to 8.2 are no longer supported. It is recommended that all users upgrade to a supported release. Abstract IP ID randomization was not enabled by default and the randomization algorithms were not strong enough. Technical Details = 1. IPv4 and IPv6 fragment ids were not randomly generated by default. Furthermore the randomization algorithms were not strong enough. 2. The TCP ISS random generation had an information leak. 3. The IPv6 flow label generation algorithm was not strong enough. Solutions and Workarounds = For all NetBSD versions, you need to obtain fixed kernel sources, rebuild and install the new kernel, and reboot the system. The following revisions fix the issues: src/sys/netinet/in_var.h1.99,1.102 src/sys/netinet/ip6.h 1.30 src/sys/netinet/ip_input.c 1.400 src/sys/netinet/tcp_subr.c 1.285,1.286 src/sys/netinet/tcp_timer.c 1.96 src/sys/netinet6/ip6_id.c 1.20 src/sys/netinet6/ip6_var.h 1.88 The fixed source may be obtained from the NetBSD CVS repository. The following instructions briefly summarise how to upgrade your kernel. In these instructions, replace: ARCH with your architecture (from uname -m), and KERNCONF with the name of your kernel configuration file. To update from CVS, re-build, and re-install the kernel: # cd src # cvs update -d -P sys/netinet sys/netinet6 # ./build.sh kernel=KERNCONF # mv /netbsd /netbsd.old # cp sys/arch/ARCH/compile/obj/KERNCONF/netbsd /netbsd # shutdown -r now For more information on how to do this, see: https://www.NetBSD.org/docs/guide/en/chap-kernel.html Thanks To = Amit Klein for reporting these vulnerabilities and Taylor R. Campbell for fixing them. More Information Advisories may be updated as new information becomes available. The most recent version of this advisory (PGP signed) can be found at https://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2021-001.txt.asc Information about NetBSD and NetBSD security can be found at https://www.NetBSD.org/ https://www.NetBSD.org/Security/ Copyright 2021, The NetBSD Foundation, Inc. All Rights Reserved. Redistribution permitted only in full, unmodified form. -BEGIN PGP SIGNATURE- iQIcBAEBAgAGBQJgSn73AAoJEIkmHhf170n/jpYQAKzk+vo/CDcYchOk+/wgPhBL TbG6rxD3xAVD1aH/sz1lviYTBE5i3W+RohJtZtvUAEoSivFuAODw3TYH/S+KWhDY IyZ1shNICPTqB1dCrgjiQpmOq9fYQ4i0zpGHhvkqWGjWXMnN2nMy37fPvsZ2TvG2 WrwKThptM8Ls6aB+K4Fg0NcHW6ifdvbXY5r2ddXftoT+zsbW9mclfu9spsAHQtLh I11GedEU7BOsvT/woFW6mG3VsHPUXofaC5BTINEiJq1o/VE9HoRmhp05Ik+NCwCv BTzLrKmpOkMJzPp3wvOE2TeolyG57rw1LrHHh6Y/Zb4BIJb6mDP03xuaulRvHg/i D27/p8qvK4lxSVQtwci15TUa45MbW/nAGMgDEPuMHxEAxwqcfZtdlTiCSSSUuVZV BxBaW6hB1gTpkNxmtMt7H0W09xbfgztQndHlZaWv2vTeOlHHKO6298C43g12PS/M pGd3XD3e1hrdrxjtfmiA8oZgOqCM6GJdGpaxE6sBWsVHNyNVurgGI1h5orW9OzO1 vuK6iwq8AZtIp5s/IFddbdFyTNGuzc4gdNx/ON9CnuJRTJ5pWEABYH25imf3fcfU wRqpGwB2oOMdKnQ56o0qMykuSurXbJNM65R3xlijjuZrclt7cr6Kz3uO+zRr0yGM 1MAq4vRQavtS6+04kZiV =Oxq5 -END PGP SIGNATURE-
