Compare commits

...

80 Commits
hm ... main

Author SHA1 Message Date
Solar Designer
f44a183786 LKRG 0.9.9 for EL 9.4 and 8.10
All checks were successful
mkdocs build / build (push) Successful in 30s
2024-10-23 05:07:03 +02:00
652f5248b7 Merge pull request 'openssh 8.7p1-38.4.el9_4.security.0.9' (#40) from solardiz-patch-38 into main
All checks were successful
mkdocs build / build (push) Successful in 30s
Reviewed-on: security/wiki#40
Reviewed-by: Neil Hanlon <neil@noreply@resf.org>
2024-08-08 12:53:34 +00:00
Solar Designer
7838177933 openssh 8.7p1-38.4.el9_4.security.0.9 2024-08-07 16:05:55 +02:00
408a1d9b2b Merge pull request 'solardiz-patch-37' (#39) from solardiz-patch-37 into main
All checks were successful
mkdocs build / build (push) Successful in 30s
Reviewed-on: security/wiki#39
Reviewed-by: Neil Hanlon <neil@noreply@resf.org>
2024-07-08 19:03:14 +00:00
Solar Designer
10816e23f7 openssh 8.7p1-38.1.el9_4.security.0.7 2024-07-08 20:44:12 +02:00
Solar Designer
f50b00f455 Update the recent note on the repo coming disabled by default 2024-07-08 20:24:39 +02:00
9cc930872e Merge pull request 'update link and shasum for new release package, add note about enabling' (#38) from update/cve-2024-6387 into main
All checks were successful
mkdocs build / build (push) Successful in 28s
Reviewed-on: security/wiki#38
Reviewed-by: Solar Designer <solardiz@noreply@resf.org>
2024-07-03 06:53:55 +00:00
1956c199e0
update link and shasum for new release package, add note about enabling 2024-07-02 23:01:22 -04:00
9ffc253e49 Merge pull request 'openssh 8.7p1-38.el9_4.security.0.5' (#37) from solardiz-patch-36 into main
All checks were successful
mkdocs build / build (push) Successful in 29s
Reviewed-on: security/wiki#37
Reviewed-by: Neil Hanlon <neil@noreply@resf.org>
2024-07-01 12:03:33 +00:00
Solar Designer
b5cc72b142 openssh 8.7p1-38.el9_4.security.0.5 2024-07-01 13:12:16 +02:00
3cc4e716cc Merge pull request 'glibc 2.34-100.2.el9_4.security.0.9' (#36) from solardiz-patch-35 into main
All checks were successful
mkdocs build / build (push) Successful in 30s
Reviewed-on: security/wiki#36
Reviewed-by: Neil Hanlon <neil@noreply@resf.org>
2024-06-14 14:30:10 +00:00
Solar Designer
71aba9fe83 glibc 2.34-100.2.el9_4.security.0.9 2024-06-13 18:12:25 +02:00
4aa4870469 Merge pull request 'lkrg 0.9.8-2.el8_10.security' (#35) from solardiz-patch-34 into main
All checks were successful
mkdocs build / build (push) Successful in 30s
Reviewed-on: security/wiki#35
Reviewed-by: Neil Hanlon <neil@noreply@resf.org>
2024-06-03 13:33:21 +00:00
Solar Designer
7c86adc2e5 lkrg 0.9.8-2.el8_10.security 2024-06-01 20:07:29 +02:00
4890fa26cc Merge pull request 'issues/CVE-2024-2961.md: Add EL8 fix, mention need to restart after fix' (#34) from solardiz-patch-33 into main
All checks were successful
mkdocs build / build (push) Successful in 29s
Reviewed-on: security/wiki#34
Reviewed-by: Neil Hanlon <neil@noreply@resf.org>
2024-05-23 20:04:34 +00:00
Solar Designer
d5049ca4e0 issues/CVE-2024-2961.md: Add EL8 fix, mention need to restart after fix 2024-05-23 15:05:39 +02:00
1e6477d853 Merge pull request 'lkrg 0.9.8-2.el9_4.security' (#33) from solardiz-patch-32 into main
All checks were successful
mkdocs build / build (push) Successful in 30s
Reviewed-on: security/wiki#33
Reviewed-by: Neil Hanlon <neil@noreply@resf.org>
2024-05-22 20:28:21 +00:00
Solar Designer
f51894ac0f lkrg 0.9.8-2.el9_4.security 2024-05-22 19:06:18 +02:00
950cb7759f Merge pull request 'Updates for 9.4' (#32) from solardiz-patch-31 into main
All checks were successful
mkdocs build / build (push) Successful in 28s
Reviewed-on: security/wiki#32
Reviewed-by: Neil Hanlon <neil@noreply@resf.org>
2024-05-22 14:11:24 +00:00
Solar Designer
0ff260473b docs/news.md: Updates for 9.4 2024-05-20 22:30:33 +02:00
Solar Designer
5c8b11d987 issues/CVE-2024-1086.md: Add EL9 fix info 2024-05-20 22:21:43 +02:00
Solar Designer
381cffb6b8 openssh 8.7p1-38.el9_4.security.0.4 2024-05-20 22:21:43 +02:00
Solar Designer
1284f07c2f glibc 2.34-100.el9_4.security.0.8 2024-05-20 22:21:38 +02:00
Solar Designer
edc7021a49 glibc 2.34-83.12.el9_3.security.0.6 nscd CVE fixes 2024-04-30 15:42:24 +02:00
41e67d41fa Merge pull request 'issues/CVE-2024-2961.md: Add a mitigation' (#31) from solardiz-patch-29 into main
All checks were successful
mkdocs build / build (push) Successful in 29s
Reviewed-on: security/wiki#31
Reviewed-by: Neil Hanlon <neil@noreply@resf.org>
2024-04-23 13:31:02 +00:00
Solar Designer
51bbca3793 issues/CVE-2024-2961.md: Add a mitigation 2024-04-23 15:21:32 +02:00
ea9aee0a60 Merge pull request 'glibc 2.34-83.12.el9_3.security.0.5 with CVE-2024-2961 fix' (#30) from solardiz-patch-28 into main
All checks were successful
mkdocs build / build (push) Successful in 28s
Reviewed-on: security/wiki#30
Reviewed-by: Neil Hanlon <neil@noreply@resf.org>
2024-04-18 18:58:19 +00:00
Solar Designer
ef8406fc79 glibc 2.34-83.12.el9_3.security.0.5 with CVE-2024-2961 fix 2024-04-18 19:15:37 +02:00
7718c9d531 Merge pull request 'Update issues/CVE-2024-1086.md' (#29) from solardiz-patch-27 into main
All checks were successful
mkdocs build / build (push) Successful in 34s
Reviewed-on: security/wiki#29
Reviewed-by: Neil Hanlon <neil@noreply@resf.org>
2024-04-18 15:37:26 +00:00
Solar Designer
cb065e6fd6 Update issues/CVE-2024-1086.md 2024-04-18 17:28:24 +02:00
ce94068981 Merge pull request 'issues/CVE-2024-1086.md: Hopefully fix mitigations list formatting' (#28) from solardiz-patch-26 into main
All checks were successful
mkdocs build / build (push) Successful in 28s
Reviewed-on: security/wiki#28
Reviewed-by: Neil Hanlon <neil@noreply@resf.org>
2024-03-28 19:37:45 +00:00
Solar Designer
f799941890 issues/CVE-2024-1086.md: Hopefully fix mitigations list formatting 2024-03-28 20:33:56 +01:00
f91c83801a Merge pull request 'Add issues/CVE-2024-1086.md' (#27) from solardiz-patch-25 into main
All checks were successful
mkdocs build / build (push) Successful in 28s
Reviewed-on: security/wiki#27
Reviewed-by: Neil Hanlon <neil@noreply@resf.org>
2024-03-28 19:06:19 +00:00
Solar Designer
615f3861cd Add issues/CVE-2024-1086.md 2024-03-28 19:54:24 +01:00
0789b72c8b Merge pull request 'openssh-8.7p1-34.3.el9_3.security.0.3' (#26) from solardiz-patch-24 into main
All checks were successful
mkdocs build / build (push) Successful in 28s
Reviewed-on: security/wiki#26
Reviewed-by: Neil Hanlon <neil@noreply@resf.org>
2024-03-18 16:46:36 +00:00
Solar Designer
8268f997d3 openssh-8.7p1-34.3.el9_3.security.0.3 2024-03-16 22:25:53 +01:00
3e4393d2d2 Merge pull request 'openssh-8.7p1-34.3.el9_3.security.0.2' (#25) from solardiz-patch-23 into main
All checks were successful
mkdocs build / build (push) Successful in 1m18s
Reviewed-on: security/wiki#25
Reviewed-by: Neil Hanlon <neil@noreply@resf.org>
2024-03-11 20:16:09 +00:00
Solar Designer
32b0012fe4 openssh-8.7p1-34.3.el9_3.security.0.2 2024-03-11 19:17:54 +01:00
426618b56d Merge pull request 'LKRG updated to version 0.9.8, which adds a remote kernel message logging capability' (#24) from solardiz-patch-22 into main
All checks were successful
mkdocs build / build (push) Successful in 29s
Reviewed-on: security/wiki#24
Reviewed-by: Neil Hanlon <neil@noreply@resf.org>
2024-02-28 02:31:42 +00:00
Solar Designer
c89e24167d LKRG 0.9.8 2024-02-28 03:10:34 +01:00
4bf396fca2 Merge pull request 'Further EL9 glibc security hardening in response Qualys' findings' (#23) from solardiz-patch-21 into main
All checks were successful
mkdocs build / build (push) Successful in 1m21s
Reviewed-on: security/wiki#23
Reviewed-by: Neil Hanlon <neil@noreply@resf.org>
2024-02-01 22:03:20 +00:00
Solar Designer
1dd1f8b5d1 Further EL9 glibc security hardening in response Qualys' findings 2024-01-31 21:39:29 +01:00
e7518933d6 Merge pull request 'control-pam: Add unix_chkpwd and pam_timestamp_check' (#22) from solardiz-patch-20 into main
All checks were successful
mkdocs build / build (push) Successful in 27s
Reviewed-on: security/wiki#22
Reviewed-by: Neil Hanlon <neil@noreply@resf.org>
2024-01-03 17:00:09 +00:00
Solar Designer
5fca69cd11 control-pam: Add unix_chkpwd and pam_timestamp_check 2024-01-03 15:01:52 +01:00
0480992c7a Merge pull request 'control-pam: Add password hashing and password policy controls' (#21) from solardiz-patch-19 into main
All checks were successful
mkdocs build / build (push) Successful in 27s
Reviewed-on: security/wiki#21
Reviewed-by: Neil Hanlon <neil@noreply@resf.org>
2023-12-28 15:25:49 +00:00
Solar Designer
a270dfad83 control-pam: Add password hashing and password policy controls 2023-12-27 21:22:55 +01:00
f4e48668bc Merge pull request 'Rename updates to news, link to it from index' (#20) from solardiz-patch-18 into main
All checks were successful
mkdocs build / build (push) Successful in 25s
Reviewed-on: security/wiki#20
Reviewed-by: Neil Hanlon <neil@noreply@resf.org>
2023-12-18 23:05:00 +00:00
Solar Designer
33eddd58ca Rename updates to news, link to it from index 2023-12-18 23:49:16 +01:00
7da8a71413 Merge pull request 'Add updates.md' (#19) from solardiz-patch-17 into main
All checks were successful
mkdocs build / build (push) Successful in 27s
Reviewed-on: security/wiki#19
Reviewed-by: Neil Hanlon <neil@noreply@resf.org>
2023-12-18 22:33:55 +00:00
Solar Designer
d9b72d5e11 Add updates.md 2023-12-18 23:27:20 +01:00
5556b38adf Merge pull request 'Revise packages/control.md, add control-util-linux' (#18) from solardiz-patch-16 into main
All checks were successful
mkdocs build / build (push) Successful in 29s
Reviewed-on: security/wiki#18
Reviewed-by: Neil Hanlon <neil@noreply@resf.org>
2023-12-18 21:29:44 +00:00
Solar Designer
1eba3cba20 Revise packages/control.md, add control-util-linux 2023-12-18 22:16:07 +01:00
af432a5b33 Merge pull request 'Add packages/control.md' (#17) from solardiz-patch-15 into main
All checks were successful
mkdocs build / build (push) Successful in 29s
Reviewed-on: security/wiki#17
Reviewed-by: Neil Hanlon <neil@noreply@resf.org>
2023-12-14 22:29:06 +00:00
Solar Designer
decdfc0aa8 Add packages/control.md 2023-12-14 23:03:43 +01:00
50aad985ed Merge pull request 'Assorted updates and corrections' (#16) from solardiz-patch-14 into main
All checks were successful
mkdocs build / build (push) Successful in 27s
Reviewed-on: security/wiki#16
Reviewed-by: Neil Hanlon <neil@noreply@resf.org>
2023-11-27 13:49:16 +00:00
Solar Designer
7afadb07a7 Document libpasswdqc-devel 2023-11-25 14:15:40 +01:00
Solar Designer
45cd03115f LKRG rebuild for 9.3 and 8.9 2023-11-25 14:08:18 +01:00
Solar Designer
c89ea05f83 glibc-2.34-83.7.el9_3.security.0.3 2023-11-25 14:01:32 +01:00
Solar Designer
1e8dfe97bc openssh-8.7p1-34.el9_3.security.0.1 2023-11-25 13:53:01 +01:00
Solar Designer
858a965314 Update for new rocky-release-security 2023-11-25 13:49:33 +01:00
6c43fd1729 Merge pull request 'Corrections on microcode_ctl for EL8' (#15) from solardiz-patch-13 into main
All checks were successful
mkdocs build / build (push) Successful in 27s
Reviewed-on: security/wiki#15
Reviewed-by: Neil Hanlon <neil@noreply@resf.org>
2023-11-19 20:04:07 +00:00
Solar Designer
166936bcbf Corrections on microcode_ctl for EL8 2023-11-19 19:26:59 +01:00
d719891f5d Merge pull request 'Add microcode_ctl for EL8' (#14) from solardiz-patch-12 into main
All checks were successful
mkdocs build / build (push) Successful in 27s
Reviewed-on: security/wiki#14
Reviewed-by: Neil Hanlon <neil@noreply@resf.org>
2023-11-16 23:31:32 +00:00
Solar Designer
b4d2b3b8be Add microcode_ctl for EL8 2023-11-16 23:10:28 +00:00
50a81d42ed Merge pull request 'Add pages for lkrg and passwdqc' (#13) from solardiz-patch-11 into main
All checks were successful
mkdocs build / build (push) Successful in 27s
Reviewed-on: security/wiki#13
Reviewed-by: Neil Hanlon <neil@noreply@resf.org>
2023-11-16 19:31:10 +00:00
Solar Designer
61a91f576c Add packages/passwdqc.md 2023-11-16 20:21:27 +01:00
Solar Designer
d5719a5314 Add packages/lkrg.md 2023-11-16 19:53:40 +01:00
3a5e3ab476 Merge pull request 'Use relative cross-links between issue and package pages' (#12) from solardiz-patch-10 into main
All checks were successful
mkdocs build / build (push) Successful in 28s
Reviewed-on: security/wiki#12
Reviewed-by: Neil Hanlon <neil@noreply@resf.org>
2023-11-15 23:54:24 +00:00
Solar Designer
414bca6267 Use relative cross-links between issue and package pages 2023-11-16 00:39:40 +01:00
4cb56ee1c2 Merge pull request 'Fix-up the previous set of changes' (#11) from solardiz-patch-9 into main
All checks were successful
mkdocs build / build (push) Successful in 30s
Reviewed-on: security/wiki#11
Reviewed-by: Neil Hanlon <neil@noreply@resf.org>
2023-11-15 23:23:34 +00:00
Solar Designer
9f3c99b709 Fix-up the previous set of changes 2023-11-15 23:17:01 +01:00
ef5faa348c Merge pull request 'Add pages for microcode_ctl and two CVEs; edit a few things' (#10) from solardiz-patch-8 into main
All checks were successful
mkdocs build / build (push) Successful in 30s
Reviewed-on: security/wiki#10
Reviewed-by: Neil Hanlon <neil@noreply@resf.org>
2023-11-15 21:58:36 +00:00
Solar Designer
7030fdeccf Add CVE-2023-23583 2023-11-15 21:49:20 +00:00
Solar Designer
c4abc1b08e Add CVE-2023-4911 2023-11-15 21:49:20 +00:00
Solar Designer
94e3e0ac16 Document DNF_VAR_sigcontentdir=/pub/sig 2023-11-15 21:49:20 +00:00
Solar Designer
d0d1d444d4 Re-point hardened_malloc link from external to local page 2023-11-15 21:49:20 +00:00
Solar Designer
cf390f30fa Add microcode_ctl 2023-11-15 21:49:20 +00:00
9b24cfd2e1 Merge pull request 'Revise hardened_malloc page and update it for 12-3' (#9) from solardiz-patch-7 into main
All checks were successful
mkdocs build / build (push) Successful in 27s
Reviewed-on: security/wiki#9
Reviewed-by: Neil Hanlon <neil@noreply@resf.org>
2023-11-15 18:48:20 +00:00
Solar Designer
fb08f8ef49 Revise hardened_malloc page and update it for 12-3 2023-11-15 19:35:14 +01:00
da39666fee Merge pull request 'Initial hardened_malloc wiki page' (#8) from flawedworld/wiki:hm into main
All checks were successful
mkdocs build / build (push) Successful in 28s
Reviewed-on: security/wiki#8
Reviewed-by: Solar Designer <solardiz@noreply@resf.org>
2023-11-14 20:42:44 +00:00
15 changed files with 720 additions and 35 deletions

View File

@ -2,6 +2,8 @@
The Security SIG repositories provide extra security-related packages and security-hardened override packages (replacing those from the main distribution) for Rocky Linux and other Enterprise Linux (EL) distributions.
If you've been to this wiki before, you'll likely want to check out [what's new](news).
## Responsibilities
Developing and maintaining various security related packages that are not in upstream EL. Identifying, developing, and maintaining security hardening changes relative to upstream EL packages. Occasionally including/backporting additional security fixes that are not yet in upstream EL packages. Contributing to the respective upstreams where practical.
@ -18,30 +20,39 @@ dnf install rocky-release-security
Download the release package containing our repository configuration file and package signing public key. Use the version that corresponds to the major version of your EL distro.
- [rocky-release-security-9](https://download.rockylinux.org/pub/rocky/9/extras/x86_64/os/Packages/r/rocky-release-security-9-2.el9.noarch.rpm)
- [rocky-release-security-8](https://download.rockylinux.org/pub/rocky/8/extras/x86_64/os/Packages/r/rocky-release-security-8-2.el8.noarch.rpm)
- [rocky-release-security-9](https://download.rockylinux.org/pub/rocky/9/extras/x86_64/os/Packages/r/rocky-release-security-9-4.el9.noarch.rpm)
- [rocky-release-security-8](https://download.rockylinux.org/pub/rocky/8/extras/x86_64/os/Packages/r/rocky-release-security-8-3.el8.noarch.rpm)
Verify the package file's SHA-256 digest with `sha256sum`. The currently expected digests are:
```
8daf0934c8b5cfce1f5c2dc53ea0118102940bf307c7cc8863ab718696863da6 rocky-release-security-9-2.el9.noarch.rpm
15aebef7257d4ff3c59a3b4e45acf8fae9894a10ddd2c924dfd521033337e96c rocky-release-security-8-2.el8.noarch.rpm
4a728939103ed54518aefa3a7729921df48a2ec8dc24138b91f3bcd400afacb0 rocky-release-security-9-4.el9.noarch.rpm
8dc7912f0ab55dff4cb2b1dc9262c22aa89d911cdb680d33213737597d865006 rocky-release-security-8-3.el8.noarch.rpm
```
This isn't as secure as checking the package signature would be _if_ you previously had our package signing public key, but on another distro you probably don't have that yet, so checking the digest against its copy obtained from this separate website is a best-effort measure.
Install the package with `rpm -U --nodeps`. The `--nodeps` option is needed to bypass the dependency check on our `rocky-release` package. In essense, you're manually confirming to `rpm` that you're installing on a compatible distro.
### Note
Regardless of whether installing on Rocky or another EL distribution, the `security-common` repository for EL9 comes disabled by default out of abundance of caution because of the packages contained within the repository that override the base Rocky Linux packages.
In order to receive packages from the SIG, either enable the repository (`dnf config-manager --enable security-common`), or activate for a single DNF transaction with `dnf --enablerepo=security-common install <package>`.
## Packages
### Extra packages (for EL8 and EL9)
- [lkrg](https://lkrg.org) (Linux Kernel Runtime Guard)
- [passwdqc](https://www.openwall.com/passwdqc/) (Password/passphrase strength checking and policy enforcement)
- [lkrg](packages/lkrg.md) (Linux Kernel Runtime Guard)
- [passwdqc](packages/passwdqc.md) (password/passphrase strength checking and policy enforcement)
### Extra packages (currently only for EL9)
- [hardened_malloc](https://github.com/GrapheneOS/hardened_malloc) (Security-focused memory allocator providing the malloc API, and a script to preload it into existing program binaries)
- [control](packages/control.md) (a common interface to register and control security-relevant system facilities)
- [hardened_malloc](packages/hardened_malloc.md) (security-focused memory allocator providing the malloc API, and a script to preload it into existing program binaries)
### Override packages (for EL8 and EL9)
- [microcode_ctl](packages/microcode_ctl.md) (updates Intel CPU microcode to fix [CVE-2023-23583](issues/CVE-2023-23583.md))
### Override packages (currently only for EL9)

View File

@ -0,0 +1,31 @@
# CVE-2023-23583: microcode_ctl
## Title
CVE-2023-23583: microcode_ctl: Intel CPUs: execution of MOVSB instructions with redundant REX prefix leads to unintended system behavior
## Summary
As described by [Intel](https://www.openwall.com/lists/oss-security/2023/11/14/4):
Under certain microarchitectural conditions, Intel has identified cases where execution of an instruction (REP MOVSB) encoded with a redundant REX prefix may result in unpredictable system behavior resulting in a system crash/hang, or, in some limited scenarios, may allow escalation of privilege from CPL3 to CPL0.
and by [Red Hat](https://access.redhat.com/security/cve/CVE-2023-23583):
A security vulnerability was found in some Intel processors. Execution of REP MOVSB instructions with a redundant REX prefix may result in execution continuing at an incorrect EIP address after a micro-architectural event occurs, potentially allowing privilege escalation, information disclosure and/or a denial of service via local access.
as well as in [CVE-2023-23583](https://www.cve.org/CVERecord?id=CVE-2023-23583).
More detail is available via these [links to Intel's website](https://www.openwall.com/lists/oss-security/2023/11/14/7) and in the public disclosure by [Tavis Ormandy](https://lock.cmpxchg8b.com/reptar.html) from [Google](https://cloud.google.com/blog/products/identity-security/google-researchers-discover-reptar-a-new-cpu-vulnerability).
Public disclosure date: November 14, 2023
## EL9
- Fixed in version: `4:20231114-1.el9_2.security` available November 15, 2023
## EL8
- Fixed in version `4:20230808-2.20231009.1.el8.security` available November 19, 2023
Please refer to our [override package of microcode_ctl](../packages/microcode_ctl.md).

View File

@ -0,0 +1,27 @@
# CVE-2023-4911: glibc
## Title
CVE-2023-4911: glibc: Looney Tunables: buffer overflow in ld.so leading to privilege escalation
## Summary
As described by [Red Hat](https://access.redhat.com/security/cve/CVE-2023-4911) and in [CVE-2023-4911](https://www.cve.org/CVERecord?id=CVE-2023-4911):
A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the `GLIBC_TUNABLES` environment variable. This issue could allow a local attacker to use maliciously crafted `GLIBC_TUNABLES` environment variables when launching binaries with SUID permission to execute code with elevated privileges.
More detail is available in the [public disclosure](https://www.openwall.com/lists/oss-security/2023/10/03/2) by [Qualys](https://blog.qualys.com/vulnerabilities-threat-research/2023/10/03/cve-2023-4911-looney-tunables-local-privilege-escalation-in-the-glibcs-ld-so), the team who discovered the issue.
Public disclosure date: October 3, 2023
## EL9
- Mitigated in version: `2.34-60.el9_2.security.0.2` available October 3, 2023
- Fixed in version: `glibc-2.34-60.el9_2.7` available October 5, 2023
Besides the upstream fix, we also retained the mitigation in our [override package of glibc](../packages/glibc.md).
## EL8
- Fixed in version: `glibc-0:2.28-225.el8_8.6` available October 5, 2023
- Errata: [RLSA-2023:5455](https://errata.rockylinux.org/RLSA-2023:5455) issued October 7, 2023

View File

@ -0,0 +1,49 @@
# CVE-2024-1086: kernel
## Title
CVE-2024-1086: kernel: nf_tables: use-after-free vulnerability in the nft_verdict_init() function
## Summary
As [briefly described by Red Hat](https://access.redhat.com/security/cve/CVE-2024-1086):
A flaw was found in the Netfilter subsystem in the Linux kernel. This issue occurs in the `nft_verdict_init()` function, allowing positive values as a drop error within the hook verdict, therefore, the `nf_hook_slow()` function can cause a double-free vulnerability when `NF_DROP` is issued with a drop error that resembles `NF_ACCEPT`. The `nf_tables` component can be exploited to achieve local privilege escalation.
Exploitation of the flaw is [described in great detail in a blog post by Notselwyn](https://pwning.tech/nftables/).
Public disclosure date: March 26, 2024 for the above blog post, which made the issue widely known
## EL9
- Fixed in version: `kernel-5.14.0-427.16.1.el9_4` available May 8, 2024
## EL8
- Fixed in version: `kernel-4.18.0-513.24.1.el8_9` available April 5, 2024
- Errata: [RLSA-2024:1607](https://errata.rockylinux.org/RLSA-2024:1607) issued April 5, 2024
## Mitigation
We also recommend two mitigations:
- If you don't use containers, we recommend that you disable user namespaces e.g. by running the below commands as root:
```
echo user.max_user_namespaces=0 > /etc/sysctl.d/userns.conf
sysctl -p /etc/sysctl.d/userns.conf
```
This is a mitigation also suggested by Red Hat.
It is sufficient to fully mitigate this and other/future related vulnerabilities.
- If you cannot disable user namespaces, you may nevertheless be able to [disable network namespaces](https://www.openwall.com/lists/oss-security/2024/04/14/1), which is also sufficient to fully mitigate this and some other/future related vulnerabilities.
- Install our [package of LKRG](../packages/lkrg.md), start and enable the service.
This does not fully mitigate the vulnerability,
but it reliably prevents the specific exploit referenced above from working and produces LKRG alerts when the exploit is run.
LKRG's feature that does so is its allow list for the kernel's usermodehelper.
This will similarly prevent other/future exploits that abuse usermodehelper.
The remaining risks are Denial of Service (DoS) as even interrupted exploits may leave the system in an unstable state,
and a different exploit of the same vulnerability bypassing LKRG.

View File

@ -0,0 +1,50 @@
# CVE-2024-2961: glibc
## Title
CVE-2024-2961: glibc: Out of bounds write in iconv may lead to remote code execution
## Summary
As [described by Red Hat](https://access.redhat.com/security/cve/CVE-2024-2961):
An out-of-bounds write flaw was found in the ISO-2022-CN-EXT plugin for glibc's iconv library. When converting from UCS4 charset, adding certain escape charterers is required to indicate where the charset was changed to the library. During this process, iconv improperly checks the boundaries of internal buffers, leading to a buffer overflow, which allows writing up to 3 bytes outside the desired memory location. This issue may allow an attacker to craft a malicious characters sequence that will trigger the out-of-bounds write and perform remote code execution, presenting a high impact to the Integrity, Confidentiality, and Availability triad.
and as [further discussed on oss-security](https://www.openwall.com/lists/oss-security/2024/04/18/4):
On PHP [this glibc bug led] to amazing results: a new exploitation technique that affects the whole PHP ecosystem.
Public disclosure date: April 17, 2024
## EL9
- Fixed in version: `2.34-83.12.el9_3.security.0.5` available April 18, 2024
## EL8
- Fixed in version: `2.28-236.el8_9.13` available May 7, 2024
- Errata: [RLSA-2024:2722](https://errata.rockylinux.org/RLSA-2024:2722) issued May 9, 2024
## Mitigation
Support for the ISO-2022-CN-EXT character set can be excluded from glibc's iconv(3) by editing `/usr/lib64/gconv/gconv-modules.d/gconv-modules-extra.conf` to comment out the below 3 lines at line 1254 (same line number in EL9 and EL8) and then regenerating the cache file:
```
alias ISO2022CNEXT// ISO-2022-CN-EXT//
module ISO-2022-CN-EXT// INTERNAL ISO-2022-CN-EXT 1
module INTERNAL ISO-2022-CN-EXT// ISO-2022-CN-EXT 1
```
These two steps can be accomplished by running the below commands as root:
```
sed -i -r 's/^(.*ISO-2022-CN-EXT.*)$/#\1/' /usr/lib64/gconv/gconv-modules.d/gconv-modules-extra.conf
iconvconfig
```
To make sure this has worked as intended, we also recommend that you run `iconv -l | grep ISO-2022-CN-EXT` before and after the above procedure. It should list the ISO-2022-CN-EXT character set before the procedure, but produce empty output afterwards.
## Making the fix or mitigation effective
After installing a fixed version of glibc or/and applying the mitigation,
you'll need to restart any long-running processes for which the bug matters (such as PHP-FPM).

View File

@ -0,0 +1,30 @@
# CVE-2024-6387: openssh
## Title
CVE-2024-6387: regreSSHion: remote code execution (RCE) in OpenSSH server, exploitable at least on glibc-based Linux systems
## Summary
As [discovered by Qualys](https://www.openwall.com/lists/oss-security/2024/07/01/3) and
[summarized by OpenSSH upstream](https://www.openwall.com/lists/oss-security/2024/07/01/1):
A critical vulnerability in sshd(8) was present in Portable OpenSSH versions 8.5p1 [to] 9.7p1 (inclusive) that may allow arbitrary code execution with root privileges.
Successful exploitation has been demonstrated on 32-bit Linux/glibc systems with ASLR. Under lab conditions, the attack requires on average 6-8 hours of continuous connections up to the maximum the server will accept. Exploitation on 64-bit systems is believed to be possible but has not been demonstrated at this time. It's likely that these attacks will be improved upon.
Public disclosure date: July 1, 2024
## EL9
- Fixed in version: `8.7p1-38.el9_4.security.0.5` available July 1, 2024
## EL8
- Unaffected
## Mitigation
Set `LoginGraceTime 0` in `/etc/ssh/sshd_config` and do a `systemctl restart sshd`.
A drawback of this mitigation is that it will make the SSH server more susceptible to denial of service attacks.

View File

@ -0,0 +1,29 @@
# CVE-2024-6409: openssh
## Title
CVE-2024-6409: OpenSSH: Possible remote code execution in privsep child due to a race condition in signal handling
## Summary
As [discovered by Solar Designer (CIQ/Rocky Linux)](https://www.openwall.com/lists/oss-security/2024/07/08/2):
OpenSSH versions 8.7 and 8.8 and the corresponding portable releases call `cleanup_exit()` from `grace_alarm_handler()` when running in the privsep child process. `cleanup_exit()` was not meant to be called from a signal handler and may call other async-signal-unsafe functions. The current understanding is that in those upstream versions `cleanup_exit()` would not actually call async-signal-unsafe functions under those conditions, but with downstream distribution patches it sometimes does. Specifically, openssh-7.6p1-audit.patch found in Red Hat's package of OpenSSH adds code to `cleanup_exit()` that exposes the issue. Relevantly, this patch is found in EL 9, where the package is based on OpenSSH 8.7p1.
This is an EL9-specific issue similar to [CVE-2024-6387 regreSSHion](CVE-2024-6387.md).
Public disclosure date: July 8, 2024
## EL9
- Fixed in version: `8.7p1-38.1.el9_4.security.0.7` available July 8, 2024
## EL8
- Unaffected
## Mitigation
Set `LoginGraceTime 0` in `/etc/ssh/sshd_config` and do a `systemctl restart sshd`.
A drawback of this mitigation is that it will make the SSH server more susceptible to denial of service attacks.

133
docs/news.md Normal file
View File

@ -0,0 +1,133 @@
# News
These are what we consider significant SIG/Security news items, not an exhaustive list of package updates and wiki edits.
## October 23, 2024
[lkrg](packages/lkrg.md) (Linux Kernel Runtime Guard) is updated to version 0.9.9, built for both EL 9.4 and 8.10.
## August 7, 2024
[openssh](packages/openssh.md) `8.7p1-38.4.el9_4.security.0.9` for EL9 is a rebase on RH's release with a CVE-2024-6409 fix,
plus a further change of our own to suppress warnings about unsupported GSSAPI on systems configured for FIPS crypto-policy.
## July 8, 2024
[openssh](packages/openssh.md) `8.7p1-38.1.el9_4.security.0.7` for EL9 adds a fix for [CVE-2024-6409](issues/CVE-2024-6409.md),
an EL9-specific issue similar to [CVE-2024-6387 regreSSHion](issues/CVE-2024-6387.md).
## July 1, 2024
[openssh](packages/openssh.md) `8.7p1-38.el9_4.security.0.5` for EL9 adds a fix for [CVE-2024-6387 regreSSHion](issues/CVE-2024-6387.md).
EL8 is unaffected.
## June 13, 2024
[glibc](packages/glibc.md) `2.34-100.2.el9_4.security.0.9` is a rebase on `2.34-100.el9_4.2`,
where we switch to RH's backport of the iconv and nscd security fixes.
## June 1, 2024
[lkrg](packages/lkrg.md) `0.9.8-2.el8_10.security` is a rebuild of Linux Kernel Runtime Guard for EL 8.10,
which wasn't strictly necessary this time as our build for 8.9 also remained working on 8.10 as-is.
## May 22, 2024
[lkrg](packages/lkrg.md) `0.9.8-2.el9_4.security` is a rebuild of Linux Kernel Runtime Guard for EL 9.4.
## May 20, 2024
[glibc](packages/glibc.md) `2.34-100.el9_4.security.0.8` contains all of our changes so far rebased on top of 9.4's `2.34-100`,
which was still missing the iconv and nscd security fixes, so our addition of those is still relevant.
[openssh](packages/openssh.md) rebased on 9.4's `8.7p1-38`.
The status page on [CVE-2024-1086](issues/CVE-2024-1086.md) has been updated to refer to EL9 fix.
## April 30, 2024
Unreleased [glibc](packages/glibc.md) `2.34-83.12.el9_3.security.0.6` includes nscd CVE-2024-33599, CVE-2024-33600, CVE-2024-33601, CVE-2024-33602 fixes from upstream glibc 2.34 branch.
This update ended up unreleased because we refocused on 9.4.
## April 18-23, 2024
Our hardened EL9 [glibc](packages/glibc.md) updated to include glibc upstream fix for [CVE-2024-2961](issues/CVE-2024-2961.md).
On that CVE status page, we also provide a mitigation for both EL9 and EL8.
The status page on [CVE-2024-1086](issues/CVE-2024-1086.md) has been updated to refer to EL8 fix and errata, suggest disabling network namespaces, explain remaining risks with LKRG.
## March 28, 2024
We've just set up a status page on [CVE-2024-1086](issues/CVE-2024-1086.md),
currently listing two mitigations for this Linux kernel vulnerability.
## March 11 to 16, 2024
[openssh](packages/openssh.md) rebased on upstream EL 8.7p1-34.3 with fixes for CVE-2023-48795 (Terrapin attack) and CVE-2023-51385, now building it without Kerberos support (further shortens `ldd sshd` from 20 to 13 lines, down from 28 lines in upstream EL).
## February 28, 2024
[lkrg](packages/lkrg.md) updated to version 0.9.8, which adds a remote kernel message logging capability.
## January 31, 2024
Further EL9 [glibc](packages/glibc.md) security hardening in response to the [recent](https://www.openwall.com/lists/oss-security/2024/01/30/6) [findings](https://www.openwall.com/lists/oss-security/2024/01/30/7) by Qualys.
## January 3, 2024
[control](packages/control.md) `0.8.0-7` can now manage two SUID root PAM helper programs `unix_chkpwd` and `pam_timestamp_check`.
## December 27, 2023
[control](packages/control.md) `0.8.0-5` can now manage user password hashing scheme and password policy in use by PAM-aware programs.
## December 18, 2023
This SIG/Security News wiki page has been created, retroactively identifying and listing selected news items so far.
[control](packages/control.md) `0.8.0-4` can now manage 3 privileged programs from `util-linux` (and `util-linux-core`): `mount`, `umount` (one "facility" for both), and `write`. Its wiki page has been reworked.
## December 14, 2023
[control](packages/control.md) wiki page added, documenting the new package.
`control` provides a common interface to register and control (what it calls) system facilities.
This is intended primarily for facilities that can potentially be dangerous to system security, to let you enable, disable, or configure each facility.
A typical facility is a SUID/SGID/setcap program or a configuration setting of a service.
Included initially are facility specifications corresponding to the `shadow-utils` package. Currently, these allow to `control` access to 5 privileged programs - 3 of them (`chage`, `gpasswd`, and `newgrp`) are by default SUID root and 2 (`newuidmap` and `newgidmap`) are `cap_setuid=ep`.
## November 25, 2023
Everything we had so far has been updated for EL 9.3 and 8.9, including our hardened EL9 [glibc](packages/glibc.md) and [openssh](packages/openssh.md) packages rebased on 9.3's and [lkrg](packages/lkrg.md) rebuilt for 9.3's and 8.9's kernels, along with re-testing and wiki edits.
The `rocky-release-security` package containing our repository configuration has been made (a while earlier) easier to use on EL distros other than Rocky Linux, and we've now updated the wiki accordingly.
## November 16 to 19, 2023
[microcode_ctl](packages/microcode_ctl.md) also for EL8, providing 8.9's Intel CPU microcode to fix [CVE-2023-23583](issues/CVE-2023-23583.md) a few days before general availability of our own 8.9 release as a whole.
## November 16, 2023
Wiki pages [lkrg](packages/lkrg.md) and [passwdqc](packages/passwdqc.md) have been created. We had these extra packages for a while, but previously only had wiki pages for override packages (referring solely to upstream homepages for the extra packages).
## November 15, 2023
We've started maintaining wiki pages for selected high profile security issues, initially for glibc [CVE-2023-4911](CVE-2023-4911.md) and Intel CPU microcode [CVE-2023-23583](issues/CVE-2023-23583.md).
[microcode_ctl](packages/microcode_ctl.md) for EL9, providing latest Intel CPU microcode to fix [CVE-2023-23583](issues/CVE-2023-23583.md) ahead of availability of a rebuilt new upstream package.
## October 31 to November 15, 2023
[hardened_malloc](packages/hardened_malloc.md) package - a security-focused memory allocator providing the `malloc(3)` API, and a script to preload it into existing program binaries. Its documentation on the wiki.
## October 13, 2023
We've started maintaining per-package wiki pages, initially for the override packages of [glibc](packages/glibc.md) and [openssh](packages/openssh.md).
We've added instructions for installation of Rocky Linux SIG/Security repository on other EL distros (non-Rocky).
## October 3, 2023
Initial wiki content documenting what we had so far, which included override packages of [glibc](packages/glibc.md) and [openssh](packages/openssh.md) and extra packages of [lkrg](packages/lkrg.md) and [passwdqc](packages/passwdqc.md) (even though these per-package wiki pages did not exist yet, so we instead had summaries and external links on the front page only), the repository package, [source code repositories](https://git.rockylinux.org/sig/security/src), and [Mattermost channel](https://chat.rockylinux.org/rocky-linux/channels/security).

110
docs/packages/control.md Normal file
View File

@ -0,0 +1,110 @@
# Extra package: control
## EL9
- Version `0.8.0-7.el9_3.security`
### Package summary
`control` provides a common interface to register and control (what it calls) system facilities.
This is intended primarily for facilities that can potentially be dangerous to system security, to let you enable, disable, or configure each facility.
A typical facility is a configuration setting of a service or a SUID/SGID/setcap program, or a closely related group of such settings and/or programs that are managed together.
We manage permissions on SUID/SGID/setcap programs because those programs pose risk to system security in case of vulnerabilities in them or in library code they use.
`control` originates in Owl and is actively maintained in ALT Linux.
### Usage in Rocky Linux
While the original `control` package in Owl and ALT Linux merely provides the common interface mentioned above for other packages to register their facilities with (and many packages in those distros do), it's been adapted in Rocky Linux to provide its own sub-packages with facility specifications and RPM trigger scripts for other packages coming from EL. This way, we can `control` those facilities and have custom settings persist (be automatically saved and restored) over package upgrades without us having to maintain forks of those other packages.
The available facilities, their current settings, and lists of possible settings can be queried by running the `control` command without parameters. With all currently available sub-packages installed and upstream default settings, its output is:
```
chage public (public restricted)
gpasswd public (public wheelonly restricted)
mount public (public wheelonly unprivileged restricted)
newgidmap public (public wheelonly restricted)
newgrp public (public wheelonly restricted)
newuidmap public (public wheelonly restricted)
pam_timestamp_check public (public restricted)
password-hash sha512crypt (sha512crypt yescrypt)
password-policy pwquality (pwquality passwdqc)
unix_chkpwd public (public restricted)
write public (public restricted)
```
With maximum security hardening, it changes to:
```
chage restricted (public restricted)
gpasswd restricted (public wheelonly restricted)
mount restricted (public wheelonly unprivileged restricted)
newgidmap restricted (public wheelonly restricted)
newgrp restricted (public wheelonly restricted)
newuidmap restricted (public wheelonly restricted)
pam_timestamp_check restricted (public restricted)
password-hash yescrypt (sha512crypt yescrypt)
password-policy passwdqc (pwquality passwdqc)
unix_chkpwd restricted (public restricted)
write restricted (public restricted)
```
Please refer to `control(8)` man page for command-line usage syntax.
### Sub-packages
Currently, there are 4 sub-packages:
#### control
The main package providing the common interface, but no facilities of its own.
#### control-shadow-utils
Facility specifications corresponding to the `shadow-utils` package. Currently, these allow to `control` access to 5 privileged programs - 3 of them (`chage`, `gpasswd`, and `newgrp`) are by default SUID root and 2 (`newuidmap` and `newgidmap`) are `cap_setuid=ep`.
#### control-util-linux
Facility specifications corresponding to the `util-linux` and `util-linux-core` packages. Currently, these allow to `control` access to 3 privileged programs - 2 of them (`mount` and `umount`) are by default SUID root and 1 (`write`) SGID `tty`.
#### control-pam
Facility specifications corresponding to the `pam` package. Currently, these allow to `control` user password hashing scheme and password policy in use by PAM-aware programs, as well as two SUID root PAM helper programs `unix_chkpwd` and `pam_timestamp_check`.
### Change log
```
* Wed Jan 3 2024 Solar Designer <solar@openwall.com> 0.8.0-7
- Add unix_chkpwd and pam_timestamp_check facilities to the pam sub-package
* Wed Jan 3 2024 Solar Designer <solar@openwall.com> 0.8.0-6
- Revise password-hash and password-policy to process the underlying two
"sub-facilities" (for the two configuration files updated by each of these)
using the same logic that we had used for mount (where the two underlying
"sub-facilities" are the mount and umount programs)
* Wed Dec 27 2023 Solar Designer <solar@openwall.com> 0.8.0-5
- Install control(8) mode 755 since some of its features work as non-root
- Add sub-package with facilities and triggers for pam password hashing and
password policy
* Mon Dec 18 2023 Solar Designer <solar@openwall.com> 0.8.0-4
- Add sub-package with facilities and triggers for util-linux
* Mon Dec 18 2023 Solar Designer <solar@openwall.com> 0.8.0-3
- Rename the shadow sub-package to shadow-utils
- Rename the source files not to differentiate them by sub-package
- Add "Requires: shadow-utils" in the shadow-utils sub-package
* Wed Dec 13 2023 Solar Designer <solar@openwall.com> 0.8.0-2
- In addition to Requires(pre), also use Requires in the sub-package
- In %triggerprein_control, pre-check that the facility exists
- Use (renamed) copies of the trigger macros within this spec file
* Wed Dec 13 2023 Solar Designer <solar@openwall.com> 0.8.0-1
- Add macros for use in RPM triggers
- Add sub-package with facilities and triggers for shadow-utils
* Wed Dec 6 2023 Solar Designer <solar@openwall.com> 0.8.0-0
- Initial packaging for EL based on ALT Linux and Owl packages
```

View File

@ -2,50 +2,66 @@
## EL9
- Version `2.34-60.7.el9_2.security.0.3`
- Based on `2.34-60.el9_2.7`
- Version `2.34-100.2.el9_4.security.0.9`
- Based on `2.34-100.el9_4.2`
### Changes summary
- Distrust and/or unset many more environment variables used by current and previous glibc versions when running SUID/SGID/setcap (Owl via ALT Linux)
- When `syslog(3)`/`vsyslog(3)` is called by a SUID/SGID/setcap program without a preceding call to `openlog(3)`, don't blindly trust `__progname` for the syslog ident (Owl via ALT Linux)
- When `syslog(3)`/`vsyslog(3)` is called by a SUID/SGID/setcap program without a preceding call to `openlog(3)`, don't blindly trust `__progname` for the syslog ident (Owl via ALT Linux, further revised for Rocky Linux)
- In `syslog(3)/vsyslog(3)` use `asctime_r(3)+localtime_r(3)` instead of `strftime_r()` so that month names don't depend on current locale settings (Owl via ALT Linux)
- In `asprintf(3)/vasprintf(3)` reset the pointer to NULL on error, like BSDs do, so that the caller wouldn't access memory over an uninitialized or stale pointer (ALT Linux)
- In `fread(3)/fwrite(3)` check for potential integer overflow (ALT Linux)
- In `tmpfile(3)` use the `TMPDIR` environment variable (when not running SUID/SGID/setcap) (ALT Linux)
- When `qsort(3)` is wrongly used with a nontransitive comparison function, nevertheless be robust and avoid [memory corruption](https://www.openwall.com/lists/oss-security/2024/01/30/7) (Qualys, Rocky Linux)
#### Known-effective vulnerability mitigations and fixes
`2.34-60.el9_2.security.0.2` included mitigations sufficient to avoid security exposure of [CVE-2023-4911](https://www.openwall.com/lists/oss-security/2023/10/03/2) and a backport of upstream glibc fix of [CVE-2023-4527](https://www.openwall.com/lists/oss-security/2023/09/25/1) that was not yet in upstream EL. In the update to `2.34-60.7.el9_2.security.0.3`, we retained the mitigations while rebasing on upstream EL's package with upstream fixes for these vulnerabilities (and more).
`2.34-83.12.el9_3.security.0.6` and above includes nscd CVE-2024-33599, CVE-2024-33600, CVE-2024-33601, CVE-2024-33602 fixes from upstream glibc 2.34 branch, which upstream also included starting with `2.34-100.el9_4.2`.
`2.34-83.12.el9_3.security.0.5` and above includes `iconv(3)` ISO-2022-CN-EXT [CVE-2024-2961](../issues/CVE-2024-2961.md) fix from upstream glibc 2.34 branch, which upstream also included starting with `2.34-100.el9_4.2`.
`2.34-60.el9_2.security.0.2` included mitigations sufficient to avoid security exposure of [CVE-2023-4911](../issues/CVE-2023-4911.md) and a backport of upstream glibc fix of [CVE-2023-4527](https://www.openwall.com/lists/oss-security/2023/09/25/1) that was not yet in upstream EL. In the update to `2.34-60.7.el9_2.security.0.3` and beyond, we retained the mitigations while rebasing on upstream EL's package with upstream fixes for these vulnerabilities (and more).
In general, inclusion of additional security fixes will be "reverted" if and when those get included in upstream EL packages that we rebase our changes on.
### Change log
```
* Fri Oct 6 2023 Solar Designer <solar@openwall.com> - 2.34-60.7.el9.security.0.3
- Rebase on 2.34-60.7, drop "our" CVE-2023-4527 patch in favor of RH's
* Thu Jun 13 2024 Solar Designer <solar@openwall.com> - 2.34-100.2.el9.security.0.9
- Rebase on 2.34-100.2
* Mon Sep 25 2023 Florian Weimer <fweimer@redhat.com> - 2.34-60.7
- Fix memory leak regression in getaddrinfo (RHEL-2425)
[... upstream changes ...]
* Tue Sep 19 2023 Carlos O'Donell <carlos@redhat.com> - 2.34-60.6
- CVE-2023-4911 glibc: buffer overflow in ld.so leading to privilege escalation (RHEL-2999)
* Mon May 20 2024 Solar Designer <solar@openwall.com> - 2.34-100.el9.security.0.8
- Rebase on 2.34-100
* Tue Sep 19 2023 Carlos O'Donell <carlos@redhat.com> - 2.34-60.5
- Revert: Always call destructors in reverse constructor order (RHEL-3385)
* Tue May 07 2024 Solar Designer <solar@openwall.com> - 2.34-83.12.el9.security.0.7
- Upstream glibc 2.34 fix "nscd: Use time_t for return type of addgetnetgrentX"
* Mon Sep 18 2023 Siddhesh Poyarekar <siddhesh@redhat.com> - 2.34-60.4
- CVE-2023-4806 glibc: potential use-after-free in getaddrinfo (RHEL-2425)
* Tue Apr 30 2024 Solar Designer <solar@openwall.com> - 2.34-83.12.el9.security.0.6
- Add nscd CVE-2024-33599, CVE-2024-33600, CVE-2024-33601, CVE-2024-33602 fixes
from upstream glibc 2.34 branch
* Fri Sep 15 2023 Siddhesh Poyarekar <siddhesh@redhat.com> - 2.34-60.3
- CVE-2023-4813: potential use-after-free in gaih_inet (RHEL-2437)
* Thu Apr 18 2024 Solar Designer <solar@openwall.com> - 2.34-83.12.el9.security.0.5
- Rebase on 2.34-83.12
- Add iconv() ISO-2022-CN-EXT CVE-2024-2961 fix from upstream glibc 2.34 branch
* Fri Sep 15 2023 Carlos O'Donell <carlos@redhat.com> - 2.34-60.2
- CVE-2023-4527: Stack read overflow in getaddrinfo in no-aaaa mode (#2234715)
[... upstream changes ...]
* Wed Sep 13 2023 Florian Weimer <fweimer@redhat.com> - 2.34-60.1
- Always call destructors in reverse constructor order (RHEL-3385)
* Wed Jan 31 2024 Solar Designer <solar@openwall.com> - 2.34-83.7.el9.security.0.4
- Harden syslog ident fallback initialization to use at most 64 characters of
__progname when __libc_enable_secure, as inspired by Qualys' discovery of
related vulnerabilities in newer glibc (not yet present in this version):
https://www.openwall.com/lists/oss-security/2024/01/30/6
- Harden qsort against nontransitive comparison functions as suggested by
Qualys: https://www.openwall.com/lists/oss-security/2024/01/30/7
* Wed Nov 22 2023 Solar Designer <solar@openwall.com> - 2.34-83.7.el9.security.0.3
- Rebase on 2.34-83.7, drop "our" CVE-2023-4527 patch in favor of RH's
(a similar rebase was made on Oct 6 in 2.34-60.7.el9.security.0.3 for 9.2)
[... upstream changes ...]
* Mon Oct 2 2023 Solar Designer <solar@openwall.com> - 2.34-60.el9.security.0.2
- Add glibc-owl-alt-sanitize-env.patch stitched from several ALT Linux commits

View File

@ -2,7 +2,7 @@
## EL9
- Version `hardened_malloc-12-2.el9_2.security.x86_64`
- Version `hardened_malloc-12-3.el9_2.security`
- Based on upstream version `12`
- No plans to support older Rocky Linux versions due to glibc being too old
@ -14,13 +14,17 @@ This package ships the "normal" and "light" configurations of the [GrapheneOS](h
It is strongly reccomended to read all documentation here before deploying this package on your infrastructure.
In order to support the large amount of mappings caused by guard slabs and large allocation guard guard regions, the `vm.max_map_count` sysctl is increased as part of package installation to `1048576` in `/etc/sysctl.d/hardened_malloc.conf`. The package ships 2 builds of hardened_malloc, the regular variant, which is located at `/usr/lib64/libhardened_malloc.so` and can be preloaded using the `hardened_malloc_preload.sh` script, and the light variant, which is located at `/usr/lib64/libhardened_malloc-light.so` and can be preloaded using the `hardened_malloc_light_preload.sh` script. The preload scripts adds the relevant library to `LD_PRELOAD` and then loads the desired binary, as shown in the following example: `hardened_malloc_preload.sh uname`. Users may choose to set an OS-wide `LD_PRELOAD` with hardened_malloc. This can be done by adding the desired library, for example, `/usr/lib64/libhardened_malloc.so`, into your `/etc/ld.so.preload`. Be aware that applications where `AT_SECURE` is set, this approach will not work.
In order to support the large amount of mappings caused by guard slabs and large allocation guard regions, the `vm.max_map_count` sysctl is increased as part of package installation to `1048576` in `/etc/sysctl.d/hardened_malloc.conf`. You'll need to run `sysctl -p /etc/sysctl.d/hardened_malloc.conf` for this change to take effect without a reboot. Incidentally, [Fedora 39 made the same change](https://fedoraproject.org/wiki/Changes/IncreaseVmMaxMapCount), so it's not an exotic configuration.
It is suggested that if you wish to deploy hardened_malloc systemwide, that you deploy it in your `LD_PRELOAD` with the normal variant globally, and then for applications which are peformance sensitive, or which do not work, try them individually with the light variant using the preload script or by setting `LD_PRELOAD` within a systemd service namespace, and then if that does not resolve your issue, disabling it by running the program in it's own systemd service namespace.
The package ships 2 builds of `hardened_malloc`, the regular variant, which is located at `/usr/lib64/libhardened_malloc.so` and can be preloaded using the `hardened_malloc_preload.sh` script, and the light variant, which is located at `/usr/lib64/libhardened_malloc-light.so` and can be preloaded using the `hardened_malloc_light_preload.sh` script. The preload scripts add the relevant library to `LD_PRELOAD` and then load the desired binary, as shown in the following example: `hardened_malloc_preload.sh cat /proc/self/maps`.
Users may choose to set an OS-wide `LD_PRELOAD` with `hardened_malloc`. This can be done by adding the desired library, for example, `/usr/lib64/libhardened_malloc.so`, into your `/etc/ld.so.preload`. Be aware that for applications where `AT_SECURE` is set, this approach will not work.
It is suggested that if you wish to deploy `hardened_malloc` systemwide, that you deploy it in your `LD_PRELOAD` with the normal variant globally, and then for applications which are performance sensitive, or which fail with the normal variant, try them individually with the light variant using the preload script or by setting `LD_PRELOAD` within a systemd service namespace. If that does not resolve your issue, try disabling `hardened_malloc` by running the program in its own systemd service namespace.
### Bugs uncovered by hardened_malloc
As with all infrastructure changes, ensure you test in your staging environment extensively before deploying into production. Many packages and projects suffer from memory corruption bugs, which hardened_malloc uncovers, which when running under glibc, are not encountered during operation. Some applications may crash during usage, completely break, or break when running with certain configurations. Bugs in packages are typically the result of upstream project bugs, and should be reported there. In some cases these bugs are fixed in later versions in the upstream project, in which case the bug is an issue with Rocky Linux, and should be reported to Rocky Linux, so that the patch may be included.
As with all infrastructure changes, ensure you test in your staging environment extensively before deploying into production. Many packages and projects suffer from memory corruption bugs, which when running under glibc are not encountered during operation, but which `hardened_malloc` uncovers. Some applications may crash during usage, completely break, or break when running with certain configurations. Bugs in packages are typically a result of upstream project bugs, and should be reported there. In some cases these bugs are fixed in later versions in the upstream project, in which case the bug is an issue with Rocky Linux, and should be reported to Rocky Linux and its upstream distribution, so that the patch may be included.
| Package name | Latest version tested | Normal variant | Light variant |
|-----------------|---------------------------------------------------|----------------|---------------|
@ -30,11 +34,15 @@ As with all infrastructure changes, ensure you test in your staging environment
### Potential for issues with EDR
By nature of relying on `LD_PRELOAD`, if you have EDR software on your server, it may falsely send alerts when using hardened_malloc. If it doesn't, your EDR is probably terrible or misconfigured.
By nature of relying on `LD_PRELOAD`, if you have EDR software on your server, it may falsely send alerts when using `hardened_malloc`. If it doesn't, your EDR is probably terrible or misconfigured.
### Change log
```
* Tue Nov 14 2023 Solar Designer <solar@openwall.com> 12-3
- Package hardened_malloc_light_preload.sh
- Disable arm64 building for now (fix didn't work)
* Wed Nov 8 2023 flawedworld <flawedworld@flawed.world> 12-2
- Set CONFIG_NATIVE to false
- Mark libraries as executable (change to 755 permissions)

83
docs/packages/lkrg.md Normal file
View File

@ -0,0 +1,83 @@
# Extra package: lkrg
## EL9
- Version `0.9.9-1.el9_4.security`
- Based on upstream version `0.9.9`
## EL8
- Version `0.9.9-1.el8_10.security`
- Based on upstream version `0.9.9`
### Package summary
LKRG, or Linux Kernel Runtime Guard, is a kernel module that performs runtime integrity checking of the Linux kernel and detection of security vulnerability exploits against the kernel.
More information is available on the [LKRG homepage](https://lkrg.org) and in the documentation files included in the package.
### Usage in Rocky Linux
Due to EL's kABI stability and the `weak-modules` mechanism, which this package uses, the same binary package of LKRG usually works across different kernel revisions/builds within the same EL minor release (e.g., 9.4). Once there's a new minor release (e.g., 9.4 is upgraded to 9.5), we'll provide a new build of LKRG accordingly.
Installing the package does not automatically start LKRG nor enable it to start on system bootup. To start LKRG please use:
```
systemctl start lkrg
```
To enable LKRG on bootup please use:
```
systemctl enable lkrg
```
### Testing and recovery
Although the current package passed our own testing (on 9.4 and 8.10), we recommend that you only enable LKRG to start on system bootup after you've tested it for a while to ensure its compatibility with your system. If you nevertheless run into a boot time issue with LKRG later, you can disable it with the `nolkrg` kernel command-line option.
### Remote logging
LKRG includes a remote kernel message logging capability.
The corresponding userspace tools are found in the `lkrg-logger` sub-package.
Documentation is also included in there, in `/usr/share/doc/lkrg-logger/LOGGING`.
### Change log
```
* Wed Oct 23 2024 Solar Designer <solar@openwall.com> 0.9.9-1
- Update to 0.9.9
* Wed May 22 2024 Solar Designer <solar@openwall.com> 0.9.8-2
- Pass direct kernel-devel's build path into make
- Drop "BuildRequires: kernel" as we no longer need /lib/modules/*/build
- Add "BuildRequires: systemd" for the _unitdir RPM macro (apparently this was
previously an indirect dependency via the kernel package)
* Tue Feb 27 2024 Solar Designer <solar@openwall.com> 0.9.8-1
- Update to 0.9.8
- Add logger sub-package
- Mark the sysctl configuration file config(noreplace)
- Use "sort -V" to build against the latest installed version of kernel-devel
* Wed Nov 8 2023 Solar Designer <solar@openwall.com> 0.9.7-4
- Add a couple of upstream patches, most notably to fix kINT false positives on
EL 8.8.
* Tue Oct 24 2023 Solar Designer <solar@openwall.com> 0.9.7-3
- Use weak-modules if available so that on RHEL and its rebuilds the same LKRG
package build works across different kABI-compatible kernel revisions/builds
- Drop 32-bit x86 from ExclusiveArch since recent RHEL lacks such kernel-devel
* Thu Sep 14 2023 Solar Designer <solar@openwall.com> 0.9.7-2
- Use kernel build directory corresponding to the kernel-devel package, not to
the currently running kernel
- "BuildRequires: kernel" for the /lib/modules/* directory
- "BuildRequires: elfutils-libelf-devel" to support CONFIG_UNWINDER_ORC=y
* Thu Sep 14 2023 Solar Designer <solar@openwall.com> 0.9.7-1
- Wrote this rough RPM spec file for Red Hat'ish distros, seems to work fine on
RHEL 7, 8, 9 rebuilds, but is only reliable when there's exactly one
kernel-devel package installed at build time and it exactly matches the target
kernel version.
```

View File

@ -0,0 +1,31 @@
# Override package: microcode_ctl
## EL9
- Version `4:20231114-1.el9_2.security`
- Based on `4:20230808-2.el9`
This is our custom revision of a post-9.2 EL9 package. We use Intel's latest released microcode.
## EL8
- Version `4:20230808-2.20231009.1.el8.security`
- Based on `4:20230808-2.20231009.1.el8`
This is a rebuild of the 8.9 package as-is to make it available for 8.8. It uses Intel's fixed microcode revision that was provided to distros privately in preparation for the coordinated disclosure.
### Changes summary
For EL9:
- Update Intel CPU microcode to fix [CVE-2023-23583](../issues/CVE-2023-23583.md), temporarily dropping most documentation patches
### Change log
For EL9:
```
* Tue Nov 14 2023 Solar Designer <solar@openwall.com> - 4:20231114-1
- Update Intel CPU microcode to microcode-20231114 (fixes CVE-2023-23583),
temporarily dropping most documentation patches
```

View File

@ -2,16 +2,48 @@
## EL9
- Version `8.7p1-30.el9_2.security.0.2`
- Based on `8.7p1-30.el9_2`
- Version `8.7p1-38.4.el9_4.security.0.9`
- Based on `8.7p1-38.el9_4.4`
### Changes summary
- Instead of linking against `libsystemd`, load it dynamically in a temporary child process to avoid polluting actual `sshd`'s address space with that library and its many dependencies (shortens `ldd sshd` output from 28 to 20 lines)
- Build without Kerberos support (further shortens `ldd sshd` from 20 to 13 lines)
- Fix [CVE-2024-6409](../issues/CVE-2024-6409.md)
### Change log
```
* Wed Jul 17 2024 Solar Designer <solar@openwall.com> 8.7p1-38.4.el9_4.security.0.9
- Patch the code to silently ignore GSSAPIKeyExchange when unsupported
* Wed Jul 17 2024 Solar Designer <solar@openwall.com> 8.7p1-38.4.el9_4.security.0.8
- Rebase on 8.7p1-38.4
* Mon Jul 08 2024 Solar Designer <solar@openwall.com> 8.7p1-38.1.el9_4.security.0.7
- Fix CVE-2024-6409
* Mon Jul 08 2024 Solar Designer <solar@openwall.com> 8.7p1-38.1.el9_4.security.0.6
- Rebase on 8.7p1-38.1
* Mon Jul 01 2024 Solar Designer <solar@openwall.com> 8.7p1-38.el9_4.security.0.5
- Fix CVE-2024-6387 regreSSHion
* Mon May 20 2024 Solar Designer <solar@openwall.com> 8.7p1-38.el9_4.security.0.4
- Rebase on 8.7p1-38
* Sat Mar 16 2024 Solar Designer <solar@openwall.com> 8.7p1-34.3.el9_3.security.0.3
- Comment out GSSAPI* lines in /etc/ssh/ssh*_config.d/50-redhat.conf and patch
the code to silently ignore GSSAPIKexAlgorithms when unsupported (like it is
in our new without-Kerberos build)
* Mon Mar 11 2024 Solar Designer <solar@openwall.com> 8.7p1-34.3.el9_3.security.0.2
- Rebase 8.7p1-34.el9_3.security.0.1 on 8.7p1-34.3
- Build without Kerberos support (shortens "ldd sshd" from 20 to 13 lines)
* Wed Nov 22 2023 Solar Designer <solar@openwall.com> 8.7p1-34.el9_3.security.0.1
- Rebase 8.7p1-30.el9.security.0.2 on 8.7p1-34
* Sat Oct 07 2023 Solar Designer <solar@openwall.com> 8.7p1-30.el9.security.0.2
- Load libsystemd.so.0, not libsystemd.so, as the latter is only provided by
systemd-devel

45
docs/packages/passwdqc.md Normal file
View File

@ -0,0 +1,45 @@
# Extra package: passwdqc
## EL9
- Version `2.0.3-2.el9_2.security`
- Based on upstream version `2.0.3-2` as packaged in Fedora
## EL8
- Version `2.0.3-2.el8.security`
- Based on upstream version `2.0.3-2` as packaged in Fedora
### Package summary
`passwdqc` is a password/passphrase strength checking and policy enforcement toolset, including a PAM module (`pam_passwdqc`), command-line programs (`pwqcheck`, `pwqfilter`, and `pwqgen`), and a library (`libpasswdqc`).
More information is available on the [passwdqc homepage](https://www.openwall.com/passwdqc/) and in the documentation files (man pages and a README) included in the sub-packages below.
### Usage in Rocky Linux
There are 5 sub-packages:
#### pam_passwdqc
`pam_passwdqc` is a PAM module that is normally invoked on password changes by programs such as `passwd(1)`. It is capable of checking password or passphrase strength, enforcing a policy, and offering randomly-generated passphrases, with all of these features being optional and easily (re-)configurable.
Merely installing this sub-package does not yet configure the system to use the PAM module. To do so, on EL9 use our [control](control.md), or on either EL8 or EL9 you may edit PAM configuration files manually e.g. like [shown here](https://github.com/openwall/passwdqc/issues/19#issuecomment-1140262371).
#### passwdqc-utils
`pwqcheck` and `pwqgen` are standalone password/passphrase strength checking and random passphrase generator programs, respectively, which are usable from scripts.
The `pwqfilter` program searches, creates, or updates binary passphrase filter files, which can also be used with `pwqcheck` and `pam_passwdqc`. This can be used for checking of user-provided passwords against existing data breaches, which is recommended in the current NIST guidance, specifically in publication 800-63B sections 5.1.1.2 and A.3. Paid pre-generated filter files are available from Openwall at the project homepage above, but with this tool you can also generate your own.
#### libpasswdqc
`libpasswdqc` is the underlying library, which may also be used from third-party programs.
#### libpasswdqc-devel
This package contains development files needed for building passwdqc-aware applications, as well as documentation (man pages) for developing such applications.
#### passwdqc
`passwdqc` is a meta sub-package that installs (via dependencies) the actual sub-packages above, except for `libpasswdqc-devel`.