Re: [vserver] CVE-2016-10229: MSG_PEEK - URGENT patch needed

From: Corey Wright <undefined_at_pobox.com>
Date: Fri 19 May 2017 - 05:17:15 BST
Message-Id: <20170518231715.14d31a7c6ba9c176880b80bf@pobox.com>

On Thu, 18 May 2017 17:41:58 -0500
Corey Wright <undefined@pobox.com> wrote:

> On Thu, 18 May 2017 21:42:57 +0100
> Ben Green <ben@bristolwireless.net> wrote:
>
> > Quoting Ben Green <ben@bristolwireless.net>:
> >
> > > I'm compiling 3.18.53-vs2.3.7.5 now.
> > >
> > > My scripts take care of [2] automatically, so I dropped in at no
> > > errors other than offsets.
> > >
> > > Cheers,
> > > Ben
> >
> > 3.18.53-vs2.3.7.5 is now in the repositories.
> >
> > I'm also trying to build 4.1.39, but there's errors (build log attached).
>
> based upon my initial investigation, it appears that the problem is
> that patch-4.1.36-37.xz did:
>
> -int inode_change_ok(const struct inode *inode, struct iattr *attr)
> +int setattr_prepare(struct dentry *dentry, struct iattr *attr)
>
> see
> https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit/?h=linux-4.1.y&id=cb8e1eef351b640cfdb1a753ef44494fbf59186d
> for details.
>
> the linux-vserver patch needs to be modified to use setattr_prepare()
> instead of inode_change_ok() and pass it dentry instead of inode
> (which is readily available being passed into __vc_set_iattr()).

patch attached to correct linux-4.1.39-vs2.3.8.5.2 source.

1. tar -xf linux-4.1.39.tar.xz
2. patch -d linux-4.1.39 -p1 <patch-4.1.35-vs2.3.8.5.2.diff
3. mv linux-4.1.39{,-vs2.3.8.5.2}
4. patch -d linux-4.1.39 -p1 <patch-4.1.35-37-vs2.3.8.5.2.diff
5. cd linux-4.1.39-vs2.3.8.5.2
6. make config
7. make

resulting kernel tested as per my usual process:
* testme.sh
* testfs.sh
* start, enter, & stop vserver guest
* start, enter (ie lxc-console & lxc-attach), & stop lxc guest
* run ansible playbook to install security updates in guests

corey

--
undefined@pobox.com
> corey
> --
> undefined@pobox.com
> 
> > Cheers,
> > Ben
> 

Received on Fri May 19 05:17:05 2017
[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Fri 19 May 2017 - 05:17:06 BST by hypermail 2.1.8