diff options
| author | Franz Pletz <fpletz@fnordicwalking.de> | 2016-07-12 20:56:50 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2016-07-12 20:56:50 +0200 |
| commit | dde259dfb5a0787b28e260da7575079bbabad6c3 (patch) | |
| tree | 92034976cb884d1ceed73ed9b8630805519ed41d | |
| parent | 724224f8f7c1c3badf7028d27698d6b0e59dc1a1 (diff) | |
| download | nixlib-dde259dfb5a0787b28e260da7575079bbabad6c3.tar nixlib-dde259dfb5a0787b28e260da7575079bbabad6c3.tar.gz nixlib-dde259dfb5a0787b28e260da7575079bbabad6c3.tar.bz2 nixlib-dde259dfb5a0787b28e260da7575079bbabad6c3.tar.lz nixlib-dde259dfb5a0787b28e260da7575079bbabad6c3.tar.xz nixlib-dde259dfb5a0787b28e260da7575079bbabad6c3.tar.zst nixlib-dde259dfb5a0787b28e260da7575079bbabad6c3.zip | |
linux: Add patch to fix CVE-2016-5829 (#16824)
Fixed for all available 4.x series kernels. From CVE-2016-5829: Multiple heap-based buffer overflows in the hiddev_ioctl_usage function in drivers/hid/usbhid/hiddev.c in the Linux kernel through 4.6.3 allow local users to cause a denial of service or possibly have unspecified other impact via a crafted (1) HIDIOCGUSAGES or (2) HIDIOCSUSAGES ioctl call.
| -rw-r--r-- | pkgs/os-specific/linux/kernel/patches.nix | 10 | ||||
| -rw-r--r-- | pkgs/top-level/all-packages.nix | 23 |
2 files changed, 28 insertions, 5 deletions
diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix index a5de48298e11..4f8d57acc17b 100644 --- a/pkgs/os-specific/linux/kernel/patches.nix +++ b/pkgs/os-specific/linux/kernel/patches.nix @@ -1,4 +1,4 @@ -{ stdenv, fetchurl, pkgs }: +{ stdenv, fetchurl, fetchpatch, pkgs }: let @@ -140,4 +140,12 @@ rec { { name = "qat_common_Makefile"; patch = ./qat_common_Makefile.patch; }; + + hiddev_CVE_2016_5829 = + { name = "hiddev_CVE_2016_5829"; + patch = fetchpatch { + url = "https://sources.debian.net/data/main/l/linux/4.6.3-1/debian/patches/bugfix/all/HID-hiddev-validate-num_values-for-HIDIOCGUSAGES-HID.patch"; + sha256 = "14rm1qr87p7a5prz8g5fwbpxzdp3ighj095x8rvhm8csm20wspyy"; + }; + }; } diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 38d7250d2800..4d40567f262e 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -10938,7 +10938,10 @@ in }; linux_4_1 = callPackage ../os-specific/linux/kernel/linux-4.1.nix { - kernelPatches = [ kernelPatches.bridge_stp_helper ] + kernelPatches = + [ kernelPatches.bridge_stp_helper + kernelPatches.hiddev_CVE_2016_5829 + ] ++ lib.optionals ((platform.kernelArch or null) == "mips") [ kernelPatches.mips_fpureg_emu kernelPatches.mips_fpu_sigill @@ -10947,7 +10950,11 @@ in }; linux_4_4 = callPackage ../os-specific/linux/kernel/linux-4.4.nix { - kernelPatches = [ kernelPatches.bridge_stp_helper kernelPatches.qat_common_Makefile ] + kernelPatches = + [ kernelPatches.bridge_stp_helper + kernelPatches.qat_common_Makefile + kernelPatches.hiddev_CVE_2016_5829 + ] ++ lib.optionals ((platform.kernelArch or null) == "mips") [ kernelPatches.mips_fpureg_emu kernelPatches.mips_fpu_sigill @@ -10956,7 +10963,11 @@ in }; linux_4_5 = callPackage ../os-specific/linux/kernel/linux-4.5.nix { - kernelPatches = [ kernelPatches.bridge_stp_helper kernelPatches.qat_common_Makefile ] + kernelPatches = + [ kernelPatches.bridge_stp_helper + kernelPatches.qat_common_Makefile + kernelPatches.hiddev_CVE_2016_5829 + ] ++ lib.optionals ((platform.kernelArch or null) == "mips") [ kernelPatches.mips_fpureg_emu kernelPatches.mips_fpu_sigill @@ -10965,7 +10976,11 @@ in }; linux_4_6 = callPackage ../os-specific/linux/kernel/linux-4.6.nix { - kernelPatches = [ kernelPatches.bridge_stp_helper kernelPatches.qat_common_Makefile ] + kernelPatches = + [ kernelPatches.bridge_stp_helper + kernelPatches.qat_common_Makefile + kernelPatches.hiddev_CVE_2016_5829 + ] ++ lib.optionals ((platform.kernelArch or null) == "mips") [ kernelPatches.mips_fpureg_emu kernelPatches.mips_fpu_sigill |