diff options
| author | Armin Kuster <akuster@mvista.com> | 2015-09-08 17:22:26 -0700 |
|---|---|---|
| committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2016-01-30 12:01:43 +0000 |
| commit | ddfe191355a042e6995f7b4b725b108c5bb4d36e (patch) | |
| tree | cdc3afc769f82d7ffb6e5d43c1c7014ba3e81cf5 /meta/recipes-connectivity/openssh/openssh/CVE-2015-6564.patch | |
| parent | 576f63c50badd54b47cdda42a6466bb18984958d (diff) | |
| download | openembedded-core-ddfe191355a042e6995f7b4b725b108c5bb4d36e.tar.gz openembedded-core-ddfe191355a042e6995f7b4b725b108c5bb4d36e.tar.bz2 openembedded-core-ddfe191355a042e6995f7b4b725b108c5bb4d36e.zip | |
openssh: CVE-2015-6563 CVE-2015-6564 CVE-2015-6565
three security fixes.
CVE-2015-6563 (Low) openssh: Privilege separation weakness related to PAM support
CVE-2015-6564 (medium) openssh: Use-after-free bug related to PAM support
CVE-2015-6565 (High) openssh: Incorrectly set TTYs to be world-writable
(From OE-Core rev: 259df232b513367a0a18b17e3e377260a770288f)
Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster@mvista.com>
Conflicts:
meta/recipes-connectivity/openssh/openssh_6.6p1.bb
Diffstat (limited to 'meta/recipes-connectivity/openssh/openssh/CVE-2015-6564.patch')
| -rw-r--r-- | meta/recipes-connectivity/openssh/openssh/CVE-2015-6564.patch | 34 |
1 files changed, 34 insertions, 0 deletions
diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2015-6564.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2015-6564.patch new file mode 100644 index 0000000000..588d42d766 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2015-6564.patch @@ -0,0 +1,34 @@ +CVE-2015-6564 + + set sshpam_ctxt to NULL after free + + Avoids use-after-free in monitor when privsep child is compromised. + Reported by Moritz Jodeit; ok dtucker@ + +Upstream-Status: Backport +https://github.com/openssh/openssh-portable/commit/5e75f5198769056089fb06c4d738ab0e5abc66f7 + +Signed-off-by: Armin Kuster <akuster@mvista.com> + +Index: openssh-6.7p1/monitor.c +=================================================================== +--- openssh-6.7p1.orig/monitor.c ++++ openssh-6.7p1/monitor.c +@@ -1128,14 +1128,16 @@ mm_answer_pam_respond(int sock, Buffer * + int + mm_answer_pam_free_ctx(int sock, Buffer *m) + { ++ int r = sshpam_authok != NULL && sshpam_authok == sshpam_ctxt; + + debug3("%s", __func__); + (sshpam_device.free_ctx)(sshpam_ctxt); ++ sshpam_ctxt = sshpam_authok = NULL; + buffer_clear(m); + mm_request_send(sock, MONITOR_ANS_PAM_FREE_CTX, m); + auth_method = "keyboard-interactive"; + auth_submethod = "pam"; +- return (sshpam_authok == sshpam_ctxt); ++ return r; + } + #endif + |