From 73577a2b05c2fe89c7ecaf030caf76f5148301da Mon Sep 17 00:00:00 2001 From: Joachim Fasting Date: Fri, 17 Feb 2017 19:08:14 +0100 Subject: [PATCH 1/2] linux_4_9: 4.9.9 -> 4.9.10 --- pkgs/os-specific/linux/kernel/linux-4.9.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix index ac51cb73a91..103c8f6c698 100644 --- a/pkgs/os-specific/linux/kernel/linux-4.9.nix +++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix @@ -1,12 +1,12 @@ { stdenv, fetchurl, perl, buildLinux, ... } @ args: import ./generic.nix (args // rec { - version = "4.9.9"; + version = "4.9.10"; extraMeta.branch = "4.9"; src = fetchurl { url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz"; - sha256 = "1vnr6688gg8njmivdzlx21v1f3w02ahca194bjvm15apajcccd96"; + sha256 = "098mcq3rg05gpammcdfhr2xhcy69ggc9h5g18m4ymnfqdx3havmx"; }; kernelPatches = args.kernelPatches; From e8007c0e8911fbcd99268b0b30d3e9f069f22c20 Mon Sep 17 00:00:00 2001 From: Joachim Fasting Date: Fri, 17 Feb 2017 19:09:50 +0100 Subject: [PATCH 2/2] linux_4_9: patch for CVE-2017-5986 Seems fairly low impact[1] but we might as well patch it until a new 4.9 version is released [1]: https://bugzilla.redhat.com/show_bug.cgi?id=1420276 --- pkgs/os-specific/linux/kernel/patches.nix | 9 +++++++++ pkgs/top-level/all-packages.nix | 1 + 2 files changed, 10 insertions(+) diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix index 33f11ad5ae3..9bc47dd624d 100644 --- a/pkgs/os-specific/linux/kernel/patches.nix +++ b/pkgs/os-specific/linux/kernel/patches.nix @@ -175,4 +175,13 @@ rec { }; }; + sctp_bug_on_CVE_2017_5986 = rec + { name = "sctp_BUG_ON_CVE_2017_5986.patch"; + patch = fetchpatch { + inherit name; + url = "https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/patch/?id=2dcab598484185dea7ec22219c76dcdd59e3cb90"; + sha256 = "15np10bfm5yzby9zbkrh23qpm91wnprblsk0xn9yjryypnz8njxh"; + }; + }; + } diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 47bd30652f3..1b178665b81 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -11294,6 +11294,7 @@ with pkgs; # !!! 4.7 patch doesn't apply, 4.9 patch not up yet, will keep checking # kernelPatches.cpu-cgroup-v2."4.7" kernelPatches.modinst_arg_list_too_long + kernelPatches.sctp_bug_on_CVE_2017_5986 ] ++ lib.optionals ((platform.kernelArch or null) == "mips") [ kernelPatches.mips_fpureg_emu