♟ gordon

Add SA-19:01, SA-19:02, EN-19:06, and EN-19:07.

Correct wrong year in advisory text.

Hopefully I won't need this again.

Add EN-19:01 through EN-19:05.

The sqlite patch is large....

Add SA-18:15 and EN-18:16 through EN-18:18.

Adjust section for secteam.

Forgot to add this to the commit message to auto-close. This was committed as r52684.

Based on conversation with brooks, this doesn't need an advisory. Local DoS are exempt from SAs and the information leak is very low quality.

Publish FreeBSD-SA-18:14.bhyve.

Fix insufficient bounds checking in bhyve(8) device model. [SA-18:14.bhyve]

Always treat firmware request and response sizes as unsigned.

Add SA-18:13 and EN-18:13 through EN-18:15.

Fix deferred kernel loading breaks loader password. [EN-18:15.loader]

Timezone database information update. [EN-18:14.tzdata]

Fix ICMP buffer underwrite. [EN-18:13.icmp]

Fix multiple vulnerabilities in NFS server code. [SA-18:13.nfs]

I don't know enough to review this request. Maybe delphij, emaste or one of the other secteam members has more domain experience here.

Approved based on timeout from delphij.

I have no objection. I'm not sure I'm qualified to weigh in on it. If markm is okay with it, then I would go ahead with it.

Logic looks reasonable to me. I have only read through the logic, not tested it myself.

Add errata notices EN-18:09 through EN-18:12

Check to ensure the buffer returned is not NULL.

There are various cases where we modify the inp_vflag and inp_inc.inc_flags

Clear stack allocated data structure to prevent kernel memory leak.

Fix small kernel memory disclosures. [EN-18:12.mem]

Fix DoS in listen syscall over IPv6 socket. [EN-18:11.listen]

Fix NULL pointer dereference in freebsd4_getfsstat. [EN-18:10.syscall]

Fix regression in IPv6 fragment reassembly. [EN-18:09.ip]

Add SA-18:12, EN-18:08.

Fix regression in Lazy FPU remediation. [EN-18:08.lazyfpu]

Fix improper elf header parsing. [SA-18:12.elf]

Correct ELF header parsing code to prevent invalid ELF sections from

@markm Can you please specifically address the comment @jmg posted on this review (and it's ancestor)?

Add secteam instead of just me.

Add today's advisory and notices.

Fix TLB shootdown for Xen based guests. [EN-18:07.pmap]

Fix Lazy FPU information disclosure. [SA-18:07.lazyfpu]

Remove references to Perforce from the website.

Address feedback from bjk.

Perforce has removed the server components for FreeBSD.

Add today's advisories.

Update timezone database information. [EN-18:06.tzdata]

Fix multiple small kernel memory disclosures. [EN-18:05.mem]

Fix mishandling of x86 debug exceptions. [SA-18:06.debugreg]

Add SA-18:04.vt, SA-18:05.ipsec, EN-18:03.tzdata, EN-18:04.mem.

Fix multiple small kernel memory disclosures. [EN-18:04.mem]

Update timezone database information. [EN-18:03.tzdata]

Fix ipsec crash or denial of service. [SA-18:05.ipsec]

Fix vt console memory disclosure. [SA-18:04.vt]

Limit glyph count in vtfont_load to avoid integer overflow.

Add FreeBSD-SA-18:03.speculative_execution.

Add mitigations for two classes of speculative execution vulnerabilities

Update SA-18:01 with revision and a new patch.

Bump newvers and document the updated patch for SA-18:01.ipsec

Correct patches for 10.x along with updated advisory.

Correct patch for ipsec vulnerability.

Fixup the AH patch to properly compile.

Remove myself now that I have commited the NTP patches.

Add the actual patches to the doc repo. This would help people interested

NTP patches are large. Exempt myself from the limit to commit them.

Add actual patches to the doc repo. This would probably help.

Switch order of the SA and EN in the xml to sort properly.

Add SA-18:01, SA-18:02, EN-18:01, EN-18:02.

Update file(1) to new version with security update. [EN-18:02.file]

Update timezone database information. [EN-18:01.tzdata]

Fix multiple vulnerabilities in ntp. [SA-18:02.ntp]

Fix ipsec validation and use-after-free. [SA-18:01.ipsec]

Port r329561 to stable/10. There were structural changes preventing MFC.

Adding cperciva and jmg who may be able to help provide some opinions about how they think this should go.

Okay, based on that, looks good to me.

Would it be better off to just not do checksumming for this and use the source as is?

Fixup include for p4 related ports now that devel/p4 is using source.

In D13925#292062, @cem wrote:

In D13925#292058, @badfilemagic_gmail.com wrote:

Conrad, thanks for the details. I also looked at the code in the other review and it looks good. I’d expect whitened output from the ctr-aes drbg to measure ~6.5 bits when put through the sp800-90b tool. That’s roughly what you get out of 1000000 samples from RDRND on Intel.

FWIW, these processors also have RDRAND. I don't know if the RDRAND implementation is related to the CCP device TRNG or not.

I obtained some sample output from the CTR-AES DRBG via kgdb and /dev/mem:

This is fine (obviously missing the actual implementation). Adding Dean to the reviewers, he has history in doing assessments of HW TRNG and might be a good collaborator to look at the quality of the bits coming from ccp(4).

Update devel/p4d and devel/p4p to 2016.1/1598719 due to micropatching.

Update so_public_key with new key.

Update PGP key for security-officer.

Looks okay to me but I'm probably not the best person to judge. If anyone else would like to weigh in. Feel free.

Add FreeBSD-SA-17:12.openssl.

gordon (Gordon Tetlow)
User

Projects

User Details

Recent Activity
View All

Tue, Feb 5

Jan 9 2019

Dec 19 2018

Dec 12 2018

Dec 6 2018

Dec 4 2018

Nov 27 2018

Nov 14 2018

Oct 25 2018

Oct 24 2018

Oct 20 2018

Sep 27 2018

Sep 12 2018

Aug 24 2018

Aug 23 2018

Jun 21 2018

May 20 2018

May 12 2018

May 11 2018

May 8 2018

Apr 4 2018

Mar 14 2018

Mar 8 2018

Mar 7 2018

Mar 5 2018

Feb 6 2018

Feb 5 2018

Feb 4 2018

Jan 16 2018

Dec 21 2017

Dec 17 2017

Dec 15 2017

Dec 9 2017

gordon (Gordon Tetlow)User