Add pages for microcode_ctl and two CVEs; edit a few things #10

Merged
neil merged 5 commits from solardiz-patch-8 into main 2023-11-15 21:58:36 +00:00
4 changed files with 70 additions and 1 deletions

View File

@ -32,6 +32,8 @@ This isn't as secure as checking the package signature would be _if_ you previou
Install the package with `rpm -U --nodeps`. The `--nodeps` option is needed to bypass the dependency check on our `rocky-release` package. In essense, you're manually confirming to `rpm` that you're installing on a compatible distro. Install the package with `rpm -U --nodeps`. The `--nodeps` option is needed to bypass the dependency check on our `rocky-release` package. In essense, you're manually confirming to `rpm` that you're installing on a compatible distro.
You'll normally install packages from the mirrors, which should just work. However, if there's any issue with the mirrors and you uncomment our `baseurl` line instead, then on non-Rocky you'll need to use `DNF_VAR_sigcontentdir=/pub/sig dnf` in place of simply `dnf`.
## Packages ## Packages
### Extra packages (for EL8 and EL9) ### Extra packages (for EL8 and EL9)
@ -41,11 +43,12 @@ Install the package with `rpm -U --nodeps`. The `--nodeps` option is needed to b
### Extra packages (currently only for EL9) ### Extra packages (currently only for EL9)
- [hardened_malloc](https://github.com/GrapheneOS/hardened_malloc) (Security-focused memory allocator providing the malloc API, and a script to preload it into existing program binaries) - [hardened_malloc](packages/hardened_malloc.md) (Security-focused memory allocator providing the malloc API, and a script to preload it into existing program binaries)
### Override packages (currently only for EL9) ### Override packages (currently only for EL9)
- [glibc](packages/glibc.md) (adds many security-hardening changes originating from Owl and ALT Linux on top of EL package) - [glibc](packages/glibc.md) (adds many security-hardening changes originating from Owl and ALT Linux on top of EL package)
- [microcode_ctl](packages/microcode_ctl.md) (updates Intel CPU microcode to microcode-20231114, which fixes CVE-2023-23583)
- [openssh](packages/openssh.md) (fewer shared libraries exposed in sshd processes while otherwise fully matching EL package's functionality) - [openssh](packages/openssh.md) (fewer shared libraries exposed in sshd processes while otherwise fully matching EL package's functionality)
The changes are described in more detail on the per-package wiki pages linked above, as well as in the package changelogs. The changes are described in more detail on the per-package wiki pages linked above, as well as in the package changelogs.

View File

@ -0,0 +1,25 @@
# CVE-2023-23583: microcode_ctl: Intel CPUs: execution of MOVSB instructions with redundant REX prefix leads to unintended system behavior
## Summary
As described by [Intel](https://www.openwall.com/lists/oss-security/2023/11/14/4):
Under certain microarchitectural conditions, Intel has identified cases where execution of an instruction (REP MOVSB) encoded with a redundant REX prefix may result in unpredictable system behavior resulting in a system crash/hang, or, in some limited scenarios, may allow escalation of privilege from CPL3 to CPL0.
and by [Red Hat](https://access.redhat.com/security/cve/CVE-2023-23583):
A security vulnerability was found in some Intel processors. Execution of REP MOVSB instructions with a redundant REX prefix may result in execution continuing at an incorrect EIP address after a micro-architectural event occurs, potentially allowing privilege escalation, information disclosure and/or a denial of service via local access.
as well as in [CVE-2023-23583](https://www.cve.org/CVERecord?id=CVE-2023-23583).
More detail is available via these [links to Intel's website](https://www.openwall.com/lists/oss-security/2023/11/14/7) and in the public disclosure by [Tavis Ormandy](https://lock.cmpxchg8b.com/reptar.html) from [Google](https://cloud.google.com/blog/products/identity-security/google-researchers-discover-reptar-a-new-cpu-vulnerability).
Public disclosure date: November 14, 2023
## EL9
Fixed in version: `4:20231114-1.el9_2.security` available November 15, 2023
## EL8
Not fixed yet, will fix.

View File

@ -0,0 +1,23 @@
# CVE-2023-4911: glibc: Looney Tunables: buffer overflow in ld.so leading to privilege escalation
## Summary
As described by [Red Hat](https://access.redhat.com/security/cve/CVE-2023-4911) and in [CVE-2023-4911](https://www.cve.org/CVERecord?id=CVE-2023-4911):
A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the `GLIBC_TUNABLES` environment variable. This issue could allow a local attacker to use maliciously crafted `GLIBC_TUNABLES` environment variables when launching binaries with SUID permission to execute code with elevated privileges.
More detail is available in the [public disclosure](https://www.openwall.com/lists/oss-security/2023/10/03/2) by [Qualys](https://blog.qualys.com/vulnerabilities-threat-research/2023/10/03/cve-2023-4911-looney-tunables-local-privilege-escalation-in-the-glibcs-ld-so), the team who discovered the issue.
Public disclosure date: October 3, 2023
## EL9
Mitigated in version: `2.34-60.el9_2.security.0.2` available October 3, 2023
Fixed in version: `glibc-2.34-60.el9_2.7` available October 5, 2023
Besides the upstream fix, we also retained the mitigation in the [Security SIG package of glibc](packages/glibc.md).
## EL8
Fixed in version: `glibc-0:2.28-225.el8_8.6` available October 5, 2023
Errata: [RLSA-2023:5455](https://errata.rockylinux.org/RLSA-2023:5455) issued October 7, 2023

View File

@ -0,0 +1,18 @@
# Override package: microcode_ctl
## EL9
- Version `4:20231114-1.el9_2.security`
- Based on `4:20230808-2`
### Changes summary
- Update Intel CPU microcode to microcode-20231114 (fixes [CVE-2023-23583](https://www.openwall.com/lists/oss-security/2023/11/14/4)), temporarily dropping most documentation patches
### Change log
```
* Tue Nov 14 2023 Solar Designer <solar@openwall.com> - 4:20231114-1
- Update Intel CPU microcode to microcode-20231114 (fixes CVE-2023-23583),
temporarily dropping most documentation patches
```