HardenedBSD-11-STABLE-v1100056.9 - https://github.com/HardenedBSD/hardenedBSD-stable/releases/tag/HardenedB...

Highlights:

• MFC r340899: Plug some kernel memory disclosures via kevent(2). (57fd4999023fbedc45061430d5dbcdb98547b407) [FreeBSD-EN-18:12.mem CVE-2018-17155]
• MFC r340856: Ensure that directory entry padding bytes are zeroed. (3dc6e9a2e5b3a446ecb0c2c198bca46619f8590d) [FreeBSD-EN-18:12.mem CVE-2018-17155]
• MFC r339818: rcorder(8): Add support for /etc/rc.resume (9837413dd9835df60a41e4cf3e30338bee65f358)
• MFC r339808: Prevent ip_input() from panicing due to unprotected access to INADDR_HASH. [CVE candidate]
• MFC r340783: Plug some networking sysctl leaks. (e1128261727c1eedda33c25158753d4f09545d5b) [FreeBSD-EN-18:12.mem CVE-2018-17155]
• MFC r340772: Clear unused bytes in ia32_osendsig(). (782079682d680e076598653d244323b8a5b90a8a) [FreeBSD-EN-18:12.mem CVE-2018-17155]
• MFC r340771: proto: change device permissions to 0600 (91dc34763d7783d5cc2e3d268e4c8ed85ff3b166) [CVE candidate]
• MFC r340663 (rmacklem): Improve sanity checking for the dircount hint argument to NFSv3's ReaddirPlus and NFSv4's Readdir operations. (3bb4648083f3148398021abd35df925aa5c003f2) [FreeBSD-SA-18:13.nfs CVE-2018-17157 CVE-2018-17158 CVE-2018-17159]
• MFC r340699: Clear pad bytes in the struct exported by kern.ntp_pll.gettime. 6c88f7d90bde0d335bc0687a41bc141ffb55e2bf [FreeBSD-EN-18:12.mem CVE-2018-17155]
• MFC r340674: Fix another user address dereference in linux_sendmsg syscall (1162e5190b51c01b6386baec10dbcd0ddcaf4b38)
• MFC r340631: Do proper copyin of control message data in the Linux sendmsg syscall. (a7710016b5015643786ff0ceb070cae982e80ddb)
• Merge OpenSSL 1.0.2q (9424b8c43e2d3d7b45201e34799fd5c5193f7f68) [CVE-2018-5407 CVE-2018-0734]
• MFC r340205: Avoid specifying VM_PROT_EXECUTE in mappings from pipe_map and exec_map. (a1e236f6c4f29f04befe42250d20312424c12deb)
• MFC r339465: rc.initdiskless: add support for auxiliary NVRAM. (889791af8eb9cb4b19cd96d2891836e4205473f0)
• MFC 339312,339364: Restore more descriptors during VM exits. (5093c36b3316b62e306dc18ff9e2bf7eac33dbe1) [CVE candidate]
• MFC 338511: bhyve: Use MAP_GUARD when mapping guest memory ranges. (6dc9464d89d89a37d4d114ba519d004ee25649b5)
• MFC r340260 (emaste): Avoid buffer underwrite in icmp_error (6033b7ab1ac6064008c8d99b64d95ebb815e1e74) [CVE-2018-17156]
• HBSD MFC r340205: Avoid specifying VM_PROT_EXECUTE in mappings from pipe_map and exec_map. (a408354173f2c5724a9a603831936ab42c11fe82)

Installer images:
http://installer.hardenedbsd.org/pub/HardenedBSD/releases/amd64/amd64/IS...

CHECKSUM.SHA512:

SHA512 (HardenedBSD-11-STABLE-v1100056.9-amd64-bootonly.iso) = 6ba911b277a345fe7985e68695f2c83d5ff16d13e947084638652d1f5613f76e126d7976e08eab78dff36062e1e3e6958a2e625958cc3086c902a3a753db5945
SHA512 (HardenedBSD-11-STABLE-v1100056.9-amd64-disc1.iso) = 5a395012cbb2d75e478c9d110d0495488721f3814c13053d43c0a0fc833ea84229b46e09632dbdf86248724ef7f9e1cf76326dd95438405dd96cd3237d3614c5
SHA512 (HardenedBSD-11-STABLE-v1100056.9-amd64-memstick.img) = 803dd1d2a0f8560f075406cf3a98a2fb354b75aacb5c2580332111e8a99fbd3a2acc32efa0ae3361d9e5b00d087c23bd916b763002915d739e91ca6503f6f2bd
SHA512 (HardenedBSD-11-STABLE-v1100056.9-amd64-mini-memstick.img) = 9034ebe006ce99ba9dac8550285d9ca3d83b2df8c1146b37209a4822cc3937b7631ecd910805e34581dbec19969b2691aaa53db64bdbd279409a51017a6a70bd


CHECKSUM.SHA512.asc:

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEu1M4jTvZiSgVy54wgZsRom/9GI0FAlv+BkQACgkQgZsRom/9
GI2sug/+NYCxrjbWNpq5BTAmzJ+Ld5BEGDZ0Vh4crVqZAVlPaj+UIiHeAh7wHD3M
hDtNvRPk905YLt7RDdb0ieSf9oeIlqHF/Y1oY0EbQBsxcG3soiltd1QdivjraBDA
rew6WRy1RdxStChJa/ZEbmS9XFMhvfMY89MSta0FTAVYxJq8cltSbnJqHh2H34an
0QF3iIi8G6g5C7cUr6tnZRRk4e+gDhwdzrkUwQc3eA0H5y9galYI/K46GWhKIz5p
qBopHts3zHTnYJjT9k+F1DTp60SPCtDK3WKyiCsCDqoOUODO+9gTcLjQQDgcuG6A
HRmcM/+DCtmmqZPFFTRCQcglfVB1Vu1SuCEhJm/8/43UN2HgtUr7IkGzE8dTmNCs
glDGWJUPEgUPirgwlZhl0XdOgd6XjT+ybempDQaNGFnd1fPuwTcljK5imLZ6txEC
Tj/OGVyNvQla7cPRGqYHL7bMAjd4huRYezj1LLu3uvjnLHPZliv9z/Ijo6U9ssvq
RKrd5cu4wtRUvyPerP0Y7HIkv5To2Zm66ofzN3P04DnMJ+niCOebu+gE7mhiYpbo
6SgS84eWuiKZ+55NVDGrjUta0fKKvqaIjMxSxQnd3iWegEEeLDGgbZLP+IubsyPJ
P2JQahY82EaRCMWPS/BRfxvs28JZYec6Lz1JCrRKmzNQCDrwNJo=
=H8Ge
-----END PGP SIGNATURE-----


Changelog:

Oliver Pinter (1):


• HBSD MFC r340205: Avoid specifying VM_PROT_EXECUTE in mappings from pipe_map and exec_map.

Oliver Pinter + (38):

• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master
• Merge branch 'freebsd/11-stable/master' into hardened/11-stable/master

ae (9):

• MFC r340100: Do not use bzero() for the O_ICMP6TYPE opcode.
• MFC r339535: Do not allow use `create` keyword as hostname when ifconfig(8) is invoked for already existing interface.
• MFC r339545: Do not decrement RST life time if keep_alive is not turned on.
• MFC r339539: Add IPFW_RULE_JUSTOPTS flag, that is used by ipfw(8) to mark rule, that was added using "new rule format". And then, when the kernel returns rule with this flag, ipfw(8) can correctly show it.
• MFC r339533: Add sadb_x_sa2 extension to SADB_ACQUIRE requests.
• MFC r339542: Retire IPFIREWALL_NAT64_DIRECT_OUTPUT kernel option. And add ability to switch the output method in run-time. Also document some sysctl variables that can by changed for NAT64 module.
• MFC r339544: Call inet_ntop() only when its result is needed.
• Revert r340541. It requires VNET_DEFINE_STATIC() macro that is not yet merged into stable/11.
• MFC r340689: Make multiline APPLY_MASK() macro to be function-like.

avg (2):

• MFC r339591: ichwd: add support for TCO watchdog timer in Lewisburg PCH (C620)
• MFC r339595: nfsrvd_readdirplus: for some errors, do not fail the entire request

bz (1):

• MFC r340251:

emaste (19):

• MFC r312758: Add sys/capability.h deprecation warning
• MFC r306023: auditdistd: update for sys/capability.h rename
• MFC r306024: mrsas: update for sys/capability.h rename
• MFC r340137: rtld: move relro enforcement after ifunc processing
• MFC r340171: capability.h: add comment about planned removal timeline
• MFC r340076: Define NT_FREEBSD_FEATURE_CTL ELF note type
• MFC r340075: readelf: decode R_MIPS_HIGHER and R_MIPS_HIGHEST relocation types
• MFC r331078 (cem): nm: Initialize allocated memory before use
• MFC r327219: readelf: report byte size for DT_PREINIT_ARRAYSZ
• MFC r323632 (jhb): readelf: Add missing newline
• Fix objcopy for little-endian MIPS64 objects.
• MFC r338485 (jhb): libelf: Add gelf_mips64el.c to file list
• MFC r340329: build(7): clarify buildenv target can be used for non-cross builds
• MFC r340288: nvi: remove superfluous space before ^\
• MFC r340299: Octeon SDK: avoid use of uninitialized variable
• MFC r340661 (rmacklem):
• MFC r340662 (rmacklem):
• MFC r340663 (rmacklem):
• MFC r340771: proto: change device permissions to 0600

eugen (13):

• MFC r340249: ipfw.8: fix small syntax error in an example
• MFC r339465: rc.initdiskless: add support for auxiliary NVRAM.
• MFC r339472: rc.initdiskless: fix commentary grammar after r339465
• MFC r339558: New sysctl: net.inet.icmp.error_keeptags
• Unbreak build after r340670. This is direct commit to stable/11.
• MFC r339807: Prevent multicast code from panicing due to unprotected access to INADDR_HASH.
• MFC r339811: route(8): correctly return exit status when "-q" flag is used.
• MFC r339806: Prevent stf(4) from panicing due to unprotected access to INADDR_HASH.
• MFC r339816: mount_msdosfs
• MFC r339810: ipfw: implement ngtee/netgraph actions for layer-2 frames.
• MFC r339808: Prevent ip_input() from panicing due to unprotected access to INADDR_HASH.
• MFC r339817: makewhatis: do not try to operate on read-only mounted directories just to fail later.
• MFC r339818: rcorder(8):

gjb (1):

• MFC r340260 (emaste): Avoid buffer underwrite in icmp_error

hselasky (8):

• MFC r340089: Use correct type for IOCTL request argument. This fixes signed IOCTL value warnings in uhsoctl().
• MFC r340212: Sometimes the complete split packet may be queued too early and the transaction translator will return a NAK. Ignore this message and retry the complete split instead.
• MFC r340248: Don't read the USB audio sync endpoint when we don't use it to save isochronous bandwidth.
• MFC r340254: Put a size limit on the opensm.log and use bzip2(1).
• MFC r340479: Implement ktime_get_ts64() function macro in the LinuxKPI.
• MFC r340480: Define asm macro in the LinuxKPI.
• MFC r340621: Be more verbose when a sysctl fails to unregister. Print name of sysctl in question.
• MFC r340622: Minor code factoring. No functional change.

jhb (3):

• MFC 340164,340168,340170: Add custom cpu_lock_delay() for x86.
• MFC 338511: bhyve: Use MAP_GUARD when mapping guest memory ranges.
• MFC 339312,339364: Restore more descriptors during VM exits.

jkim (1):

• Merge OpenSSL 1.0.2q.

kevans (1):

• MFC r340392: Add dynamic_kenv assertion to init_static_kenv

kib (8):

• MFC r339892: Clarify explanation of VFCF_SBDRY.
• MFC r339896: Initialize ifunc calling machinery earlier.
• MFC r325771, r325777, r325778 (all by jhb):
• MFC r340136: Move the fixed base for PIE loading on arm.
• MFC r339897: Remove rtld use of libc amd64_set_fsbase().
• MFC r340487: Align IA32_ARCH_CAP MSR definitions and use with SDM rev. 068.
• MFC r340842: Silence gcc warnings.
• MFC r340675: rtld: when immediate bind mode is requested, process irelocs in PLT immediately after other PLT relocs.

kp (12):

• MFC r339464:
• MFC r339470:
• MFC r339578:
• MFC r339676:
• MFC r340065:
• MFC r340066:
• MFC r340067:
• MFC r340068:
• MFC r340070:
• MFC r340072:
• MFC r340265:
• MFC r340264:

manu (1):

• Fix dtb path for beaglebone* boards.

marius (2):

• MFC: r340495
• MFC: r339007, r340543, r340654

markj (9):

• MFC r340205: Avoid specifying VM_PROT_EXECUTE in mappings from pipe_map and exec_map.
• MFC r340699: Clear pad bytes in the struct exported by kern.ntp_pll.gettime.
• MFC r340734: Avoid unsynchronized updates to kn_status.
• MFC r340772: Clear unused bytes in ia32_osendsig().
• MFC r340783: Plug some networking sysctl leaks.
• MFC r340856: Ensure that directory entry padding bytes are zeroed.
• MFC r340899: Plug some kernel memory disclosures via kevent(2).
• MFC r340897: Lock the knlist before releasing the in-flux state in knote_fork().
• MFC r340898: Ensure that knotes do not get registered when KQ_CLOSING is set.

mmacy (2):

• Backport of r338074 - generalize uart_bus_probe and add SNPS support to x86
• e1000: Don't use 9k jumbo clusters

oshogbo (1):

• MFC r335844:

rmacklem (1):

• MFC: r339999 Fix NFS client vnode locking to avoid a crash during forced dismount.

royger (1):

• MFC r338628: xen: limit the usage of PIRQs to a legacy PVH Dom0

scottl (1):

• Fix a regression from prior to 11.2 that caused MSI (not MSI-X) interrupt allocation to fail. While here, refactor the code so that it's more clear and less likely to break in the future. This is not an MFC due to the code in 12/head being very different, but it follows the latter's structure more closely than before.

tijl (3):

• MFC r340181, r340185:
• MFC r340631:
• MFC r340674:

vangyzen (1):

• MFC r340257

wulf (1):

• MFC r337287:

ygy (1):

• MFC r338977: