IPFire-SCM August 2022

ipfire-scm@lists.ipfire.org

1 participants
13 discussions

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. f38e8a35c296f00e097b07ceb6a9800a976a0271
by Peter Müller 04 Aug '22

04 Aug '22

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via f38e8a35c296f00e097b07ceb6a9800a976a0271 (commit) from 8a0383a7cdcf5fa55d960443960124298f9a3cf1 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit f38e8a35c296f00e097b07ceb6a9800a976a0271 Author: Peter Müller <peter.mueller(a)ipfire.org> Date: Thu Aug 4 12:38:01 2022 +0000 linux: Enable randstruct on ARM as well My fault, again. :-/ Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/kernel/kernel.config.aarch64-ipfire | 3 ++- config/kernel/kernel.config.armv6l-ipfire | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) Difference in files: diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire index 7ba5344bb..af31c0c61 100644 --- a/config/kernel/kernel.config.aarch64-ipfire +++ b/config/kernel/kernel.config.aarch64-ipfire @@ -739,7 +739,8 @@ CONFIG_HAVE_GCC_PLUGINS=y CONFIG_GCC_PLUGINS=y # CONFIG_GCC_PLUGIN_CYC_COMPLEXITY is not set CONFIG_GCC_PLUGIN_LATENT_ENTROPY=y -# CONFIG_GCC_PLUGIN_RANDSTRUCT is not set +CONFIG_GCC_PLUGIN_RANDSTRUCT=y +CONFIG_GCC_PLUGIN_RANDSTRUCT_PERFORMANCE=y # end of General architecture-dependent options CONFIG_RT_MUTEXES=y diff --git a/config/kernel/kernel.config.armv6l-ipfire b/config/kernel/kernel.config.armv6l-ipfire index 3e379d312..e769ce32a 100644 --- a/config/kernel/kernel.config.armv6l-ipfire +++ b/config/kernel/kernel.config.armv6l-ipfire @@ -808,7 +808,8 @@ CONFIG_HAVE_GCC_PLUGINS=y CONFIG_GCC_PLUGINS=y # CONFIG_GCC_PLUGIN_CYC_COMPLEXITY is not set CONFIG_GCC_PLUGIN_LATENT_ENTROPY=y -# CONFIG_GCC_PLUGIN_RANDSTRUCT is not set +CONFIG_GCC_PLUGIN_RANDSTRUCT=y +CONFIG_GCC_PLUGIN_RANDSTRUCT_PERFORMANCE=y CONFIG_GCC_PLUGIN_ARM_SSP_PER_TASK=y # end of General architecture-dependent options hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 7caecf45fbaab7f681d0aa3d5ea87ca660ff4f3d
by Peter Müller 01 Aug '22

01 Aug '22

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 7caecf45fbaab7f681d0aa3d5ea87ca660ff4f3d (commit) via 67261075a370b0baa62a25d11ba2773569020785 (commit) via 7ee2eec3a2fe6aedbdf3b0db952d6cb0fdc3dbce (commit) from 1f82d37eae1d938143600b8e8b194f773a2ab8d3 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 7caecf45fbaab7f681d0aa3d5ea87ca660ff4f3d Author: Peter Müller <peter.mueller(a)ipfire.org> Date: Mon Jul 11 15:07:22 2022 +0000 linux: Give CONFIG_RANDOMIZE_BASE on aarch64 another try Quoted from https://capsule8.com/blog/kernel-configuration-glossary/: > Significance: Critical > > In support of Kernel Address Space Layout Randomization (KASLR) this randomizes > the physical address at which the kernel image is decompressed and the virtual > address where the kernel image is mapped as a security feature that deters > exploit attempts relying on knowledge of the location of kernel code internals. We tried to enable this back in 2020, and failed. Since then, things may have been improved, so let's give this low-hanging fruit another try. Fixes: #12363 Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> commit 67261075a370b0baa62a25d11ba2773569020785 Author: Peter Müller <peter.mueller(a)ipfire.org> Date: Mon Aug 1 10:19:46 2022 +0000 Core Update 170: Ship vulnerabilities.cgi Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> commit 7ee2eec3a2fe6aedbdf3b0db952d6cb0fdc3dbce Author: Peter Müller <peter.mueller(a)ipfire.org> Date: Mon Aug 1 09:32:51 2022 +0000 vulnerabilities.cgi: Add Retbleed (CVE-2022-29900, CVE-2022-29901) Please refer to https://comsec.ethz.ch/research/microarch/retbleed/ for further details on this vulnerability. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> Reviewed-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/kernel/kernel.config.aarch64-ipfire | 2 +- config/rootfiles/common/aarch64/linux | 1 + config/rootfiles/core/170/filelists/files | 1 + html/cgi-bin/vulnerabilities.cgi | 1 + langs/de/cgi-bin/de.pl | 1 + langs/en/cgi-bin/en.pl | 1 + 6 files changed, 6 insertions(+), 1 deletion(-) Difference in files: diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire index 469884b20..9232335ff 100644 --- a/config/kernel/kernel.config.aarch64-ipfire +++ b/config/kernel/kernel.config.aarch64-ipfire @@ -471,7 +471,7 @@ CONFIG_ARM64_SVE=y CONFIG_ARM64_MODULE_PLTS=y # CONFIG_ARM64_PSEUDO_NMI is not set CONFIG_RELOCATABLE=y -# CONFIG_RANDOMIZE_BASE is not set +CONFIG_RANDOMIZE_BASE=y CONFIG_CC_HAVE_STACKPROTECTOR_SYSREG=y CONFIG_STACKPROTECTOR_PER_TASK=y # end of Kernel Features diff --git a/config/rootfiles/common/aarch64/linux b/config/rootfiles/common/aarch64/linux index 6de30d1a0..dbd6e8f2f 100644 --- a/config/rootfiles/common/aarch64/linux +++ b/config/rootfiles/common/aarch64/linux @@ -9427,6 +9427,7 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/include/config/RAID6_PQ #lib/modules/KVER-ipfire/build/include/config/RAID6_PQ_BENCHMARK #lib/modules/KVER-ipfire/build/include/config/RAID_ATTRS +#lib/modules/KVER-ipfire/build/include/config/RANDOMIZE_BASE #lib/modules/KVER-ipfire/build/include/config/RANDOMIZE_KSTACK_OFFSET_DEFAULT #lib/modules/KVER-ipfire/build/include/config/RAS #lib/modules/KVER-ipfire/build/include/config/RASPBERRYPI_FIRMWARE diff --git a/config/rootfiles/core/170/filelists/files b/config/rootfiles/core/170/filelists/files index 458aba96f..2519119bb 100644 --- a/config/rootfiles/core/170/filelists/files +++ b/config/rootfiles/core/170/filelists/files @@ -6,6 +6,7 @@ srv/web/ipfire/cgi-bin/index.cgi srv/web/ipfire/cgi-bin/ipblocklist.cgi srv/web/ipfire/cgi-bin/pakfire.cgi srv/web/ipfire/cgi-bin/services.cgi +srv/web/ipfire/cgi-bin/vulnerabilities.cgi srv/web/ipfire/cgi-bin/logs.cgi/ids.dat srv/web/ipfire/cgi-bin/logs.cgi/ipblocklists.dat srv/web/ipfire/cgi-bin/logs.cgi/log.dat diff --git a/html/cgi-bin/vulnerabilities.cgi b/html/cgi-bin/vulnerabilities.cgi index 61b69210e..0edd127d7 100644 --- a/html/cgi-bin/vulnerabilities.cgi +++ b/html/cgi-bin/vulnerabilities.cgi @@ -35,6 +35,7 @@ my %VULNERABILITIES = ( "mds" => "$Lang::tr{'fallout zombieload ridl'} (CVE-2018-12126, CVE-2018-12130, CVE-2018-12127, CVE-2019-11091)", "meltdown" => "$Lang::tr{'meltdown'} (CVE-2017-5754)", "mmio_stale_data" => "$Lang::tr{'mmio stale data'} (CVE-2022-21123, CVE-2022-21125, CVE-2022-21127, CVE-2022-21166)", + "retbleed" => "$Lang::tr{'retbleed'} (CVE-2022-29900, CVE-2022-29901)", "spec_store_bypass" => "$Lang::tr{'spectre variant 4'} (CVE-2018-3639)", "spectre_v1" => "$Lang::tr{'spectre variant 1'} (CVE-2017-5753)", "spectre_v2" => "$Lang::tr{'spectre variant 2'} (CVE-2017-5715)", diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl index 6a5ce1117..d3b4c8687 100644 --- a/langs/de/cgi-bin/de.pl +++ b/langs/de/cgi-bin/de.pl @@ -2195,6 +2195,7 @@ 'restore defaults' => 'Voreinstellungen wiederherstellen', 'restore hardware settings' => 'Hardwareeinstellungen wiederherstellen', 'restore settings' => 'Einstellungen wiederherstellen', +'retbleed' => 'Retbleed', 'reverse sort' => 'In umgekehrter chronologischer Reihenfolge sortieren', 'root' => 'Root', 'root certificate' => 'Root-Zertifikat', diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index 73aa4d04a..36f97de38 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -2250,6 +2250,7 @@ 'restore defaults' => 'Restore defaults', 'restore hardware settings' => 'Restore hardware settings', 'restore settings' => 'Reset Settings', +'retbleed' => 'Retbleed', 'reverse sort' => 'Sort in reverse chronological order', 'root' => 'Root', 'root certificate' => 'Root Certificate', hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 1f82d37eae1d938143600b8e8b194f773a2ab8d3
by Peter Müller 01 Aug '22

01 Aug '22

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 1f82d37eae1d938143600b8e8b194f773a2ab8d3 (commit) from ef3ca7d6da60e1fd259a96ceadc338da3b2151b7 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 1f82d37eae1d938143600b8e8b194f773a2ab8d3 Author: Peter Müller <peter.mueller(a)ipfire.org> Date: Mon Aug 1 09:14:03 2022 +0000 Core Update 170: Silly me screwed up initscript calls :-/ Studies reveal intelligent life before the first cup of coffee is possibly in theory, but does not exist in practice. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/core/170/update.sh | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) Difference in files: diff --git a/config/rootfiles/core/170/update.sh b/config/rootfiles/core/170/update.sh index cbac8572e..e33a45f16 100644 --- a/config/rootfiles/core/170/update.sh +++ b/config/rootfiles/core/170/update.sh @@ -44,8 +44,8 @@ for (( i=1; i<=$core; i++ )); do done # Stop services -/etc/init.d/rc.d/unbound stop -/etc/init.d/rc.d/suricata stop +/etc/rc.d/init.d/unbound stop +/etc/rc.d/init.d/suricata stop KVER="xxxKVERxxx" @@ -171,8 +171,8 @@ sed -i /etc/collectd.conf \ /etc/init.d/collectd restart # Start services -/etc/init.d/rc.d/unbound start -/etc/init.d/rc.d/suricata start +/etc/rc.d/init.d/unbound start +/etc/rc.d/init.d/suricata start # Harden mount options of /boot sed -e -i "s@[[:space:]]*\/boot[[:space:]]*auto[[:space:]]*defaults[[:space:]]*@ \/boot auto defaults,nodev,noexec,nosuid @g" /etc/fstab hooks/post-receive -- IPFire 2.x development tree

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

IPFire-SCM August 2022