aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMark H Weaver <mhw@netris.org>2017-06-19 23:07:43 -0400
committerMark H Weaver <mhw@netris.org>2017-06-19 23:26:59 -0400
commit91c623aae0f10992aa46957b9072679534e4cd28 (patch)
treed52935a5a9f1220035e01b9b3fb9c20ae8f9ef42
parent53c2dc31082aa13fba7c96bb18c332119ccb787e (diff)
downloadguix-91c623aae0f10992aa46957b9072679534e4cd28.tar
guix-91c623aae0f10992aa46957b9072679534e4cd28.tar.gz
gnu: linux-libre: Add mitigation for CVE-2017-1000364.
This increases the stack guard gap size from one page to 1 MiB in linux-libre-4.11, 4.9, and 4.4, to mitigate CVE-2017-1000364 (Stack Clash). * gnu/packages/linux.scm (linux-libre, linux-libre-4.9, linux-libre-4.4): Add patch.
-rw-r--r--gnu/packages/linux.scm36
1 files changed, 33 insertions, 3 deletions
diff --git a/gnu/packages/linux.scm b/gnu/packages/linux.scm
index 7d3b4bb239..3ec423422b 100644
--- a/gnu/packages/linux.scm
+++ b/gnu/packages/linux.scm
@@ -365,19 +365,49 @@ It has been modified to remove all non-free binary blobs.")
(make-linux-libre %linux-libre-version
%linux-libre-hash
%intel-compatible-systems
- #:configuration-file kernel-config))
+ #:configuration-file kernel-config
+ #:patches
+ (list %boot-logo-patch
+ (origin
+ (method url-fetch)
+ (uri "\
+https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git/patch/?id=167ec8235f978d7af78c73e9490dae1af3fee67f")
+ (file-name "linux-libre-4.11-CVE-2017-1000364.patch")
+ (sha256
+ (base32
+ "0hv3lxjgpssvsldkydg5q7znnzxv5ncpzrk6g11q01k3gkl0q689"))))))
(define-public linux-libre-4.9
(make-linux-libre "4.9.33"
"1dam6vqymhlx1vsl0lzxphamiifgyf97snxg18b2czqq402nz094"
%intel-compatible-systems
- #:configuration-file kernel-config))
+ #:configuration-file kernel-config
+ #:patches
+ (list %boot-logo-patch
+ (origin
+ (method url-fetch)
+ (uri "\
+https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git/patch/?id=37c40b6777f0bc8a63f616479c469b371097f333")
+ (file-name "linux-libre-4.9-CVE-2017-1000364.patch")
+ (sha256
+ (base32
+ "0zhnh8ysiqldxlnd50bjrxagzx29kc8nlajdrikii2x2ibkbfb4i"))))))
(define-public linux-libre-4.4
(make-linux-libre "4.4.73"
"144ssqw1dr86z4cgl797pq5rggfibsxqk7wmfbl6j92l1cj6yjrz"
%intel-compatible-systems
- #:configuration-file kernel-config))
+ #:configuration-file kernel-config
+ #:patches
+ (list %boot-logo-patch
+ (origin
+ (method url-fetch)
+ (uri "\
+https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git/patch/?id=87422f5b9b4f43efef4eaf37d7d040aed96500cb")
+ (file-name "linux-libre-4.4-CVE-2017-1000364.patch")
+ (sha256
+ (base32
+ "137p1cpiwlbvw4x12w1l23iy593xmdry60kd7j9kk690r9arfagw"))))))
(define-public linux-libre-4.1
(make-linux-libre "4.1.41"