Skip to contentSkip to conversation

package/network-manager: bump version to 1.10.8

PATCH New Bernd Kuhls 3 participants 7 messages Oct 30, 2018 – Nov 14, 2018

lore
Share & tools
lore

Bernd Kuhls

author
#0 lore raw

PATCH 1/2 package/network-manager: bump version to 1.10.8

Added license hashes.

Signed-off-by Bernd Kuhls <[email protected]>
---
 package/network-manager/network-manager.hash | 7 +++++--
 package/network-manager/network-manager.mk   | 2 +-
 2 files changed, 6 insertions(+), 3 deletions(-)
package/network-manager/network-manager.hash +5 -2
index 8fedc64729..3439439175 100644
@@ -1,2 +1,5 @@
-# From http://ftp.gnome.org/pub/GNOME/sources/NetworkManager/1.10/NetworkManager-1.10.2.sha256sum
-sha256 169c34f50770e3c96b431f7d2cff654455246f2e6ccd46eccfb4454d4595625b  NetworkManager-1.10.2.tar.xz
+# From https://download.gnome.org/sources/NetworkManager/1.10/NetworkManager-1.10.8.sha256sum
+sha256 eb4ac8ce75fed5ec804f409caec7b54342d4e01512baf7d7fc119fd40ac8a938  NetworkManager-1.10.8.tar.xz
+# Locally computed
+sha256 49d9659a4f9a09747c320d51d3cf9dfde210de67b70862acf849890f6477b00d  COPYING
+sha256 3a2968e3abb4fea464cd8dc1146d71996f9544af91a5f687bc4f3a2932df49b4  libnm-util/COPYING
package/network-manager/network-manager.mk +1 -1
index a520aad9c0..2b9f68a030 100644
@@ -5,7 +5,7 @@
 ################################################################################
 
 NETWORK_MANAGER_VERSION_MAJOR = 1.10
-NETWORK_MANAGER_VERSION = $(NETWORK_MANAGER_VERSION_MAJOR).2
+NETWORK_MANAGER_VERSION = $(NETWORK_MANAGER_VERSION_MAJOR).8
 NETWORK_MANAGER_SOURCE = NetworkManager-$(NETWORK_MANAGER_VERSION).tar.xz
 NETWORK_MANAGER_SITE = http://ftp.gnome.org/pub/GNOME/sources/NetworkManager/$(NETWORK_MANAGER_VERSION_MAJOR)
 NETWORK_MANAGER_INSTALL_STAGING = YES
Signature · 1 line
2.19.1
author
#1 lore raw

PATCH 2/2 package/network-manager: Add upstream patch to fix CVE-2018-15688

NetworkManager includes some parts of the systemd-networkd code in its codebase. That can be found at src/systemd/src/libsystemd-networkd. The DHCP implementation provided by systemd-networkd is used when NetworkManager is configured to use the internal implementation, however the default is to use dhclient.

When NetworkManager is configured to use the internal dhcp and an interface is setup with ipv6.method=auto (which is the default value) or ipv6.method=dhcp, this flaw can be exploited. When using ipv6.method=auto, the DHCPv6 client can be automatically started with a Router Advertisement packet.

Signed-off-by Bernd Kuhls <[email protected]>
---
 ...we-have-enough-space-for-the-DHCP6-o.patch | 38 +++++++++++++++++++
 1 file changed, 38 insertions(+)
 create mode 100644 package/network-manager/0001-dhcp6-make-sure-we-have-enough-space-for-the-DHCP6-o.patch
package/network-manager/0001-dhcp6-make-sure-we-have-enough-space-for-the-DHCP6-o.patch new file +38 -0
new file mode 100644
index 0000000000..c6066abe28
@@ -0,0 +1,38 @@
+From 01ca2053bbea09f35b958c8cc7631e15469acb79 Mon Sep 17 00:00:00 2001
+From: Lennart Poettering <[email protected]>
+Date: Fri, 19 Oct 2018 12:12:33 +0200
+Subject: dhcp6: make sure we have enough space for the DHCP6 option header
+
+Fixes a vulnerability originally discovered by Felix Wilhelm from
+Google.
+
+CVE-2018-15688
+LP: #1795921
+https://bugzilla.redhat.com/show_bug.cgi?id=1639067
+
+(cherry picked from commit 4dac5eaba4e419b29c97da38a8b1f82336c2c892)
+
+Patch downloaded from upstream commit:
+https://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/?id=01ca2053bbea09f35b958c8cc7631e15469acb79
+
+Signed-off-by: Bernd Kuhls <[email protected]>
+---
+ src/systemd/src/libsystemd-network/dhcp6-option.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/systemd/src/libsystemd-network/dhcp6-option.c b/src/systemd/src/libsystemd-network/dhcp6-option.c
+index d178fe2..9027c14 100644
+--- a/src/systemd/src/libsystemd-network/dhcp6-option.c
++++ b/src/systemd/src/libsystemd-network/dhcp6-option.c
+@@ -108,7 +108,7 @@ int dhcp6_option_append_ia(uint8_t **buf, size_t *buflen, const DHCP6IA *ia) {
+                 return -EINVAL;
+         }
+ 
+-        if (*buflen < len)
++        if (*buflen < offsetof(DHCP6Option, data) + len)
+                 return -ENOBUFS;
+ 
+         ia_hdr = *buf;
+-- 
+cgit v1.1
+
Signature · 1 line
2.19.1
#2 lore raw

PATCH 2/2 package/network-manager: Add upstream patch to fix CVE-2018-15688

Quoted 8 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Bernd" == Bernd Kuhls <[email protected]> writes:

NetworkManager includes some parts of the systemd-networkd code in its codebase. That can be found at src/systemd/src/libsystemd-networkd. The DHCP implementation provided by systemd-networkd is used when NetworkManager is configured to use the internal implementation, however the default is to use dhclient.

Quoted 7 lines

When NetworkManager is configured to use the internal dhcp and an interface is setup with ipv6.method=auto (which is the default value) or ipv6.method=dhcp, this flaw can be exploited. When using ipv6.method=auto, the DHCPv6 client can be automatically started with a Router Advertisement packet.

Signed-off-by Bernd Kuhls <[email protected]>

Committed, thanks.

Signature · 1 line
Bye, Peter Korsgaard
#3 lore raw

PATCH 2/2 package/network-manager: Add upstream patch to fix CVE-2018-15688

In reply to Bernd Kuhls
Quoted 8 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Bernd" == Bernd Kuhls <[email protected]> writes:

NetworkManager includes some parts of the systemd-networkd code in its codebase. That can be found at src/systemd/src/libsystemd-networkd. The DHCP implementation provided by systemd-networkd is used when NetworkManager is configured to use the internal implementation, however the default is to use dhclient.

Quoted 7 lines

When NetworkManager is configured to use the internal dhcp and an interface is setup with ipv6.method=auto (which is the default value) or ipv6.method=dhcp, this flaw can be exploited. When using ipv6.method=auto, the DHCPv6 client can be automatically started with a Router Advertisement packet.

Signed-off-by Bernd Kuhls <[email protected]>

Committed to 2018.02.x and 2018.08.x, thanks.

Signature · 1 line
Bye, Peter Korsgaard
#4 lore raw

PATCH 1/2 package/network-manager: bump version to 1.10.8

In reply to Bernd Kuhls

Hi Bernd,

...

package/network-manager/network-manager.mk line 8

Quoted 3 lines

NETWORK_MANAGER_VERSION_MAJOR = 1.10

package/network-manager/network-manager.mk +1 -1
-NETWORK_MANAGER_VERSION = $(NETWORK_MANAGER_VERSION_MAJOR).2
+NETWORK_MANAGER_VERSION = $(NETWORK_MANAGER_VERSION_MAJOR).8

Thanks for your patch.
There is new stable branch, could you bump it into 1.12.2?

https://wiki.gnome.org/Projects/NetworkManager
https://download.gnome.org/sources/NetworkManager/1.12/NetworkManager-1.12.2.tar.xz

Kind regards,
Petr

#5 lore raw

PATCH 1/2 package/network-manager: bump version to 1.10.8

Hi Bernd,

Quoted 10 lines

...

package/network-manager/network-manager.mk line 8

Quoted 3 lines

NETWORK_MANAGER_VERSION_MAJOR = 1.10

package/network-manager/network-manager.mk +1 -1
-NETWORK_MANAGER_VERSION = $(NETWORK_MANAGER_VERSION_MAJOR).2
+NETWORK_MANAGER_VERSION = $(NETWORK_MANAGER_VERSION_MAJOR).8

Thanks for your patch.
There is new stable branch, could you bump it into 1.12.2?

https://wiki.gnome.org/Projects/NetworkManager
https://download.gnome.org/sources/NetworkManager/1.12/NetworkManager-1.12.2.tar.xz

Wiki page is outdated. Latest stable branch is 1.14.x. Can you bump to 1.14.4?
http://ftp.gnome.org/pub/GNOME/sources/NetworkManager/1.14/
http://ftp.gnome.org/pub/GNOME/sources/NetworkManager/1.14/NetworkManager-1.14.4.tar.xz
http://ftp.gnome.org/pub/GNOME/sources/NetworkManager/1.14/NetworkManager-1.14.4.sha256sum

Kind regards,
Petr