[Glibc-bsd-commits] r4523 - in trunk/kfreebsd-9/debian: . patches

[stevenc-guest at alioth.debian.org]

Author: stevenc-guest
Date: 2013-06-18 13:35:13 +0000 (Tue, 18 Jun 2013)
New Revision: 4523

Added:
   trunk/kfreebsd-9/debian/patches/SA-13_06.mmap.patch
Modified:
   trunk/kfreebsd-9/debian/changelog
   trunk/kfreebsd-9/debian/patches/series
Log:
Pick SVN 251902 from FreeBSD 9-STABLE to fix SA-13:06 / CVE-2013-2171:
Privilege escalation via mmap (Closes: #712664)


Modified: trunk/kfreebsd-9/debian/changelog
===================================================================
--- trunk/kfreebsd-9/debian/changelog	2013-06-18 12:20:03 UTC (rev 4522)
+++ trunk/kfreebsd-9/debian/changelog	2013-06-18 13:35:13 UTC (rev 4523)
@@ -1,3 +1,11 @@
+kfreebsd-9 (9.0-12) UNRELEASED; urgency=high
+
+  * Team upload.
+  * Pick SVN 251902 from FreeBSD 9-STABLE to fix SA-13:06 / CVE-2013-2171:
+    Privilege escalation via mmap (Closes: #712664)
+
+ -- Steven Chamberlain <steven at pyro.eu.org>  Tue, 18 Jun 2013 13:20:50 +0100
+
 kfreebsd-9 (9.0-11) unstable; urgency=high
 
   * Team upload.

Added: trunk/kfreebsd-9/debian/patches/SA-13_06.mmap.patch
===================================================================
--- trunk/kfreebsd-9/debian/patches/SA-13_06.mmap.patch	                        (rev 0)
+++ trunk/kfreebsd-9/debian/patches/SA-13_06.mmap.patch	2013-06-18 13:35:13 UTC (rev 4523)
@@ -0,0 +1,28 @@
+Description:
+ Fix a bug that allowed a tracing process (e.g. gdb) to write
+ to a memory-mapped file in the traced process's address space
+ even if neither the traced process nor the tracing process had
+ write access to that file. [13:06]
+ (CVE-2013-2171)
+Origin: vendor, http://security.freebsd.org/patches/SA-13:06/mmap.patch
+Bug: http://security.freebsd.org/advisories/FreeBSD-SA-13:06.mmap.asc
+Bug-Debian: http://bugs.debian.org/712664
+Applied-Upstream: http://svnweb.freebsd.org/base?view=revision&revision=251902
+
+Index: kfreebsd-9-9.0/sys/vm/vm_map.c
+===================================================================
+--- kfreebsd-9-9.0.orig/sys/vm/vm_map.c	2011-07-06 21:06:44.000000000 +0100
++++ kfreebsd-9-9.0/sys/vm/vm_map.c	2013-06-18 13:39:13.104790989 +0100
+@@ -3704,6 +3704,12 @@
+ 		vm_map_unlock_read(map);
+ 		return (KERN_PROTECTION_FAILURE);
+ 	}
++	if ((fault_typea & VM_PROT_COPY) != 0 &&
++	    (entry->max_protection & VM_PROT_WRITE) == 0 &&
++	    (entry->eflags & MAP_ENTRY_COW) == 0) {
++		vm_map_unlock_read(map);
++		return (KERN_PROTECTION_FAILURE);
++	}
+ 
+ 	/*
+ 	 * If this page is not pageable, we have to get it for all possible

Modified: trunk/kfreebsd-9/debian/patches/series
===================================================================
--- trunk/kfreebsd-9/debian/patches/series	2013-06-18 12:20:03 UTC (rev 4522)
+++ trunk/kfreebsd-9/debian/patches/series	2013-06-18 13:35:13 UTC (rev 4523)
@@ -9,6 +9,7 @@
 svn239447_SCTP_DoS.patch
 SA-12_08.linux.patch
 SA-13_05.nfsserver.patch
+SA-13_06.mmap.patch
 
 # Other patches that might or might not be mergeable
 001_misc.diff