Fri Jan 24 17:07:36 2014 UTC ()
add patch from upstream to add missing privilege check
from the advisory:
Malicious or misbehaving unprivileged guests can cause the host or other
guests to malfunction. This can result in host-wide denial of service.
Privilege escalation, while seeming to be unlikely, cannot be excluded.
Only PV guests can take advantage of this vulnerability.
(CVE-2014-1666)
bump PKGREV


(drochner)
diff -r1.30 -r1.31 pkgsrc/sysutils/xenkernel41/Makefile
diff -r1.24 -r1.25 pkgsrc/sysutils/xenkernel41/distinfo
diff -r0 -r1.1 pkgsrc/sysutils/xenkernel41/patches/patch-CVE-2014-1666
cvs diff -r1.30 -r1.31 pkgsrc/sysutils/xenkernel41/Attic/Makefile (expand / switch to unified diff)

--- pkgsrc/sysutils/xenkernel41/Attic/Makefile 2013/12/04 10:35:01 1.30
+++ pkgsrc/sysutils/xenkernel41/Attic/Makefile 2014/01/24 17:07:35 1.31
@@ -1,20 +1,20 @@ @@ -1,20 +1,20 @@
1# $NetBSD: Makefile,v 1.30 2013/12/04 10:35:01 drochner Exp $ 1# $NetBSD: Makefile,v 1.31 2014/01/24 17:07:35 drochner Exp $
2# 2#
3 3
4VERSION= 4.1.6.1 4VERSION= 4.1.6.1
5DISTNAME= xen-${VERSION} 5DISTNAME= xen-${VERSION}
6PKGNAME= xenkernel41-${VERSION} 6PKGNAME= xenkernel41-${VERSION}
7PKGREVISION= 5 7PKGREVISION= 6
8CATEGORIES= sysutils 8CATEGORIES= sysutils
9MASTER_SITES= http://bits.xensource.com/oss-xen/release/${VERSION}/ 9MASTER_SITES= http://bits.xensource.com/oss-xen/release/${VERSION}/
10 10
11MAINTAINER= cegger@NetBSD.org 11MAINTAINER= cegger@NetBSD.org
12HOMEPAGE= http://xen.org/ 12HOMEPAGE= http://xen.org/
13COMMENT= Xen 4.1.x Kernel 13COMMENT= Xen 4.1.x Kernel
14 14
15LICENSE= gnu-gpl-v2 15LICENSE= gnu-gpl-v2
16 16
17ONLY_FOR_PLATFORM= Linux-2.6*-i386 Linux-2.6*-x86_64 17ONLY_FOR_PLATFORM= Linux-2.6*-i386 Linux-2.6*-x86_64
18ONLY_FOR_PLATFORM+= NetBSD-[5-9].*-x86_64 NetBSD-[5-9].*-i386 18ONLY_FOR_PLATFORM+= NetBSD-[5-9].*-x86_64 NetBSD-[5-9].*-i386
19 19
20NO_CONFIGURE= yes 20NO_CONFIGURE= yes
cvs diff -r1.24 -r1.25 pkgsrc/sysutils/xenkernel41/Attic/distinfo (expand / switch to unified diff)

--- pkgsrc/sysutils/xenkernel41/Attic/distinfo 2013/12/04 10:35:01 1.24
+++ pkgsrc/sysutils/xenkernel41/Attic/distinfo 2014/01/24 17:07:35 1.25
@@ -1,23 +1,24 @@ @@ -1,23 +1,24 @@
1$NetBSD: distinfo,v 1.24 2013/12/04 10:35:01 drochner Exp $ 1$NetBSD: distinfo,v 1.25 2014/01/24 17:07:35 drochner Exp $
2 2
3SHA1 (xen-4.1.6.1.tar.gz) = e5f15feb0821578817a65ede16110c6eac01abd0 3SHA1 (xen-4.1.6.1.tar.gz) = e5f15feb0821578817a65ede16110c6eac01abd0
4RMD160 (xen-4.1.6.1.tar.gz) = bff11421fc44a26f2cc3156713267abcb36d7a19 4RMD160 (xen-4.1.6.1.tar.gz) = bff11421fc44a26f2cc3156713267abcb36d7a19
5Size (xen-4.1.6.1.tar.gz) = 10428485 bytes 5Size (xen-4.1.6.1.tar.gz) = 10428485 bytes
6SHA1 (patch-CVE-2013-1442) = 7aa43513ea7cddc50b4e6802412cfc2903cce8e1 6SHA1 (patch-CVE-2013-1442) = 7aa43513ea7cddc50b4e6802412cfc2903cce8e1
7SHA1 (patch-CVE-2013-4355_1) = a28e4fc0cbe5409a759e689ff1af82792f560a39 7SHA1 (patch-CVE-2013-4355_1) = a28e4fc0cbe5409a759e689ff1af82792f560a39
8SHA1 (patch-CVE-2013-4355_2) = 70fd2f2e45a05a53d8ce7d0bd72b18165dd13509 8SHA1 (patch-CVE-2013-4355_2) = 70fd2f2e45a05a53d8ce7d0bd72b18165dd13509
9SHA1 (patch-CVE-2013-4355_3) = 93f7bf877945e585fb906dbfc8159e688813c12f 9SHA1 (patch-CVE-2013-4355_3) = 93f7bf877945e585fb906dbfc8159e688813c12f
10SHA1 (patch-CVE-2013-4355_4) = 88f478997d2631ec41adfd42a9d79f2d87bb44d8 10SHA1 (patch-CVE-2013-4355_4) = 88f478997d2631ec41adfd42a9d79f2d87bb44d8
11SHA1 (patch-CVE-2013-4361) = b9074af976ba98c02aeb84288a10527bf7693241 11SHA1 (patch-CVE-2013-4361) = b9074af976ba98c02aeb84288a10527bf7693241
12SHA1 (patch-CVE-2013-4368) = 77caf392b472e5586eb2fa6a37d173cd856f6f15 12SHA1 (patch-CVE-2013-4368) = 77caf392b472e5586eb2fa6a37d173cd856f6f15
13SHA1 (patch-CVE-2013-4494) = d74dfc898d1128f3c205bd178c8cf663935711e3 13SHA1 (patch-CVE-2013-4494) = d74dfc898d1128f3c205bd178c8cf663935711e3
14SHA1 (patch-CVE-2013-4553) = 6708dcef1737b119a3fcf2e3414c22c115cbacc1 14SHA1 (patch-CVE-2013-4553) = 6708dcef1737b119a3fcf2e3414c22c115cbacc1
15SHA1 (patch-CVE-2013-6885_1) = 6fc88c8c98393e90dd895c160108ff2ee17cee2e 15SHA1 (patch-CVE-2013-6885_1) = 6fc88c8c98393e90dd895c160108ff2ee17cee2e
16SHA1 (patch-CVE-2013-6885_2) = be3c99ba3e349492d45cd4f2fce0acc26ac1a96d 16SHA1 (patch-CVE-2013-6885_2) = be3c99ba3e349492d45cd4f2fce0acc26ac1a96d
 17SHA1 (patch-CVE-2014-1666) = acf27080799d4aae6a03b556caadb01081d5314e
17SHA1 (patch-Config.mk) = a43ed1b3304d6383dc093acd128a7f373d0ca266 18SHA1 (patch-Config.mk) = a43ed1b3304d6383dc093acd128a7f373d0ca266
18SHA1 (patch-xen_Makefile) = d1c7e4860221f93d90818f45a77748882486f92b 19SHA1 (patch-xen_Makefile) = d1c7e4860221f93d90818f45a77748882486f92b
19SHA1 (patch-xen_arch_x86_Rules.mk) = 6b9b4bfa28924f7d3f6c793a389f1a7ac9d228e2 20SHA1 (patch-xen_arch_x86_Rules.mk) = 6b9b4bfa28924f7d3f6c793a389f1a7ac9d228e2
20SHA1 (patch-xen_arch_x86_cpu_mcheck_vmce.c) = 5afd01780a13654f1d21bf1562f6431c8370be0b 21SHA1 (patch-xen_arch_x86_cpu_mcheck_vmce.c) = 5afd01780a13654f1d21bf1562f6431c8370be0b
21SHA1 (patch-xen_arch_x86_time.c) = 1611959c08ad79e3f042ac70c8d9d57b60225289 22SHA1 (patch-xen_arch_x86_time.c) = 1611959c08ad79e3f042ac70c8d9d57b60225289
22SHA1 (patch-xen_drivers_char_console_c) = 0fe186369602ccffaeec6f4bfbee8bb4298d3ff0 23SHA1 (patch-xen_drivers_char_console_c) = 0fe186369602ccffaeec6f4bfbee8bb4298d3ff0
23SHA1 (patch-xen_include_xen_stdarg.h) = e9df974a9b783ed442ab17497198432cb9844b70 24SHA1 (patch-xen_include_xen_stdarg.h) = e9df974a9b783ed442ab17497198432cb9844b70
File Added: pkgsrc/sysutils/xenkernel41/patches/Attic/patch-CVE-2014-1666
$NetBSD: patch-CVE-2014-1666,v 1.1 2014/01/24 17:07:36 drochner Exp $

http://lists.xenproject.org/archives/html/xen-devel/2014-01/msg02075.html

--- xen/arch/x86/physdev.c.orig	2014-01-24 16:04:18.000000000 +0000
+++ xen/arch/x86/physdev.c	2014-01-24 16:05:09.000000000 +0000
@@ -554,7 +554,9 @@ ret_t do_physdev_op(int cmd, XEN_GUEST_H
     case PHYSDEVOP_release_msix: {
         struct physdev_pci_device dev;
 
-        if ( copy_from_guest(&dev, arg, 1) )
+        if ( !IS_PRIV(v->domain) )
+	    ret = -EPERM;
+        else if ( copy_from_guest(&dev, arg, 1) )
             ret = -EFAULT;
         else if ( dev.seg )
             ret = -EOPNOTSUPP;