diff --git a/website/data/security/advisories.toml b/website/data/security/advisories.toml index 45d0ba9cb2..491abb8a37 100644 --- a/website/data/security/advisories.toml +++ b/website/data/security/advisories.toml @@ -1,2855 +1,2863 @@ # Sort advisories by year, month and day # $FreeBSD$ +[[advisories]] +name = "FreeBSD-SA-26:11.tty" +date = "2026-04-21" + +[[advisories]] +name = "FreeBSD-SA-26:10.tty" +date = "2026-04-21" + [[advisories]] name = "FreeBSD-SA-26:09.pf" date = "2026-03-26" [[advisories]] name = "FreeBSD-SA-26:08.rpcsec_gss" date = "2026-03-26" [[advisories]] name = "FreeBSD-SA-26:07.nvmf" date = "2026-03-26" [[advisories]] name = "FreeBSD-SA-26:06.tcp" date = "2026-03-26" [[advisories]] name = "FreeBSD-SA-26:05.route" date = "2026-02-24" [[advisories]] name = "FreeBSD-SA-26:04.jail" date = "2026-02-24" [[advisories]] name = "FreeBSD-SA-26:03.blocklistd" date = "2026-02-10" [[advisories]] name = "FreeBSD-SA-26:02.jail" date = "2026-01-27" [[advisories]] name = "FreeBSD-SA-26:01.openssl" date = "2026-01-27" [[advisories]] name = "FreeBSD-SA-25:12.rtsold" date = "2025-12-16" [[advisories]] name = "FreeBSD-SA-25:11.ipfw" date = "2025-12-16" [[advisories]] name = "FreeBSD-SA-25:10.unbound" date = "2025-11-26" [[advisories]] name = "FreeBSD-SA-25:09.netinet" date = "2025-10-22" [[advisories]] name = "FreeBSD-SA-25:08.openssl" date = "2025-09-30" [[advisories]] name = "FreeBSD-SA-25:07.libarchive" date = "2025-08-08" [[advisories]] name = "FreeBSD-SA-25:06.xz" date = "2025-07-02" [[advisories]] name = "FreeBSD-SA-25:05.openssh" date = "2025-02-21" [[advisories]] name = "FreeBSD-SA-25:04.ktrace" date = "2025-01-29" [[advisories]] name = "FreeBSD-SA-25:03.etcupdate" date = "2025-01-29" [[advisories]] name = "FreeBSD-SA-25:02.fs" date = "2025-01-29" [[advisories]] name = "FreeBSD-SA-25:01.openssh" date = "2025-01-29" [[advisories]] name = "FreeBSD-SA-24:19.fetch" date = "2024-10-29" [[advisories]] name = "FreeBSD-SA-24:18.ctl" date = "2024-10-29" [[advisories]] name = "FreeBSD-SA-24:17.bhyve" date = "2024-10-29" [[advisories]] name = "FreeBSD-SA-24:16.libnv" date = "2024-09-19" [[advisories]] name = "FreeBSD-SA-24:15.bhyve" date = "2024-09-19" [[advisories]] name = "FreeBSD-SA-24:14.umtx" date = "2024-09-04" [[advisories]] name = "FreeBSD-SA-24:13.openssl" date = "2024-09-04" [[advisories]] name = "FreeBSD-SA-24:12.bhyve" date = "2024-09-04" [[advisories]] name = "FreeBSD-SA-24:11.ctl" date = "2024-09-04" [[advisories]] name = "FreeBSD-SA-24:10.bhyve" date = "2024-09-04" [[advisories]] name = "FreeBSD-SA-24:09.libnv" date = "2024-09-04" [[advisories]] name = "FreeBSD-SA-24:08.openssh" date = "2024-08-07" [[advisories]] name = "FreeBSD-SA-24:07.nfsclient" date = "2024-08-07" [[advisories]] name = "FreeBSD-SA-24:06.ktrace" date = "2024-08-07" [[advisories]] name = "FreeBSD-SA-24:05.pf" date = "2024-08-07" [[advisories]] name = "FreeBSD-SA-24:04.openssh" date = "2024-07-01" [[advisories]] name = "FreeBSD-SA-24:03.unbound" date = "2024-03-28" [[advisories]] name = "FreeBSD-SA-24:02.tty" date = "2024-02-14" [[advisories]] name = "FreeBSD-SA-24:01.bhyveload" date = "2024-02-14" [[advisories]] name = "FreeBSD-SA-23:19.openssh" date = "2023-12-19" [[advisories]] name = "FreeBSD-SA-23:18.nfsclient" date = "2023-12-12" [[advisories]] name = "FreeBSD-SA-23:17.pf" date = "2023-12-05" [[advisories]] name = "FreeBSD-SA-23:16.cap_net" date = "2023-11-08" [[advisories]] name = "FreeBSD-SA-23:15.stdio" date = "2023-11-08" [[advisories]] name = "FreeBSD-SA-23:14.smccc" date = "2023-10-03" [[advisories]] name = "FreeBSD-SA-23:13.capsicum" date = "2023-10-03" [[advisories]] name = "FreeBSD-SA-23:12.msdosfs" date = "2023-10-03" [[advisories]] name = "FreeBSD-SA-23:11.wifi" date = "2023-09-06" [[advisories]] name = "FreeBSD-SA-23:10.pf" date = "2023-09-06" [[advisories]] name = "FreeBSD-SA-23:09.pam_krb5" date = "2023-08-01" [[advisories]] name = "FreeBSD-SA-23:08.ssh" date = "2023-08-01" [[advisories]] name = "FreeBSD-SA-23:07.bhyve" date = "2023-08-01" [[advisories]] name = "FreeBSD-SA-23:06.ipv6" date = "2023-08-01" [[advisories]] name = "FreeBSD-SA-23:05.openssh" date = "2023-06-21" [[advisories]] name = "FreeBSD-SA-23:04.pam_krb5" date = "2023-06-21" [[advisories]] name = "FreeBSD-SA-23:03.openssl" date = "2023-02-16" [[advisories]] name = "FreeBSD-SA-23:02.openssh" date = "2023-02-16" [[advisories]] name = "FreeBSD-SA-23:01.geli" date = "2023-02-08" [[advisories]] name = "FreeBSD-SA-22:15.ping" date = "2022-11-29" [[advisories]] name = "FreeBSD-SA-22:14.heimdal" date = "2022-11-15" [[advisories]] name = "FreeBSD-SA-22:13.zlib" date = "2022-08-30" [[advisories]] name = "FreeBSD-SA-22:12.lib9p" date = "2022-08-09" [[advisories]] name = "FreeBSD-SA-22:11.vm" date = "2022-08-09" [[advisories]] name = "FreeBSD-SA-22:10.aio" date = "2022-08-09" [[advisories]] name = "FreeBSD-SA-22:09.elf" date = "2022-08-09" [[advisories]] name = "FreeBSD-SA-22:08.zlib" date = "2022-04-06" [[advisories]] name = "FreeBSD-SA-22:07.wifi_meshid" date = "2022-04-06" [[advisories]] name = "FreeBSD-SA-22:06.ioctl" date = "2022-04-06" [[advisories]] name = "FreeBSD-SA-22:05.bhyve" date = "2022-04-06" [[advisories]] name = "FreeBSD-SA-22:04.netmap" date = "2022-04-06" [[advisories]] name = "FreeBSD-SA-22:03.openssl" date = "2022-03-15" [[advisories]] name = "FreeBSD-SA-22:02.wifi" date = "2022-03-15" [[advisories]] name = "FreeBSD-SA-22:01.vt" date = "2022-01-11" [[advisories]] name = "FreeBSD-SA-21:17.openssl" date = "2021-08-24" [[advisories]] name = "FreeBSD-SA-21:16.openssl" date = "2021-08-24" [[advisories]] name = "FreeBSD-SA-21:15.libfetch" date = "2021-08-24" [[advisories]] name = "FreeBSD-SA-21:14.ggatec" date = "2021-08-24" [[advisories]] name = "FreeBSD-SA-21:13.bhyve" date = "2021-08-24" [[advisories]] name = "FreeBSD-SA-21:12.libradius" date = "2021-05-26" [[advisories]] name = "FreeBSD-SA-21:11.smap" date = "2021-05-26" [[advisories]] name = "FreeBSD-SA-21:10.jail_mount" date = "2021-04-06" [[advisories]] name = "FreeBSD-SA-21:09.accept_filter" date = "2021-04-06" [[advisories]] name = "FreeBSD-SA-21:08.vm" date = "2021-04-06" [[advisories]] name = "FreeBSD-SA-21:07.openssl" date = "2021-03-25" [[advisories]] name = "FreeBSD-SA-21:06.xen" date = "2021-02-24" [[advisories]] name = "FreeBSD-SA-21:05.jail_chdir" date = "2021-02-24" [[advisories]] name = "FreeBSD-SA-21:04.jail_remove" date = "2021-02-24" [[advisories]] name = "FreeBSD-SA-21:03.pam_login_access" date = "2021-02-24" [[advisories]] name = "FreeBSD-SA-21:02.xenoom" date = "2021-01-29" [[advisories]] name = "FreeBSD-SA-21:01.fsdisclosure" date = "2021-01-29" [[advisories]] name = "FreeBSD-SA-20:33.openssl" date = "2020-12-08" [[advisories]] name = "FreeBSD-SA-20:32.rtsold" date = "2020-12-01" [[advisories]] name = "FreeBSD-SA-20:31.icmp6" date = "2020-12-01" [[advisories]] name = "FreeBSD-SA-20:30.ftpd" date = "2020-09-15" [[advisories]] name = "FreeBSD-SA-20:29.bhyve_svm" date = "2020-09-15" [[advisories]] name = "FreeBSD-SA-20:28.bhyve_vmcs" date = "2020-09-15" [[advisories]] name = "FreeBSD-SA-20:27.ure" date = "2020-09-15" [[advisories]] name = "FreeBSD-SA-20:26.dhclient" date = "2020-09-02" [[advisories]] name = "FreeBSD-SA-20:25.sctp" date = "2020-09-02" [[advisories]] name = "FreeBSD-SA-20:24.ipv6" date = "2020-09-02" [[advisories]] name = "FreeBSD-SA-20:23.sendmsg" date = "2020-08-05" [[advisories]] name = "FreeBSD-SA-20:22.sqlite" date = "2020-08-05" [[advisories]] name = "FreeBSD-SA-20:21.usb_net" date = "2020-08-05" [[advisories]] name = "FreeBSD-SA-20:20.ipv6" date = "2020-07-08" [[advisories]] name = "FreeBSD-SA-20:19.unbound" date = "2020-07-08" [[advisories]] name = "FreeBSD-SA-20:18.posix_spawnp" date = "2020-07-08" [[advisories]] name = "FreeBSD-SA-20:17.usb" date = "2020-06-09" [[advisories]] name = "FreeBSD-SA-20:16.cryptodev" date = "2020-05-12" [[advisories]] name = "FreeBSD-SA-20:15.cryptodev" date = "2020-05-12" [[advisories]] name = "FreeBSD-SA-20:14.sctp" date = "2020-05-12" [[advisories]] name = "FreeBSD-SA-20:13.libalias" date = "2020-05-12" [[advisories]] name = "FreeBSD-SA-20:12.libalias" date = "2020-05-12" [[advisories]] name = "FreeBSD-SA-20:11.openssl" date = "2020-04-21" [[advisories]] name = "FreeBSD-SA-20:10.ipfw" date = "2020-04-21" [[advisories]] name = "FreeBSD-SA-20:09.ntp" date = "2020-03-19" [[advisories]] name = "FreeBSD-SA-20:08.jail" date = "2020-03-19" [[advisories]] name = "FreeBSD-SA-20:07.epair" date = "2020-03-19" [[advisories]] name = "FreeBSD-SA-20:06.if_ixl_ioctl" date = "2020-03-19" [[advisories]] name = "FreeBSD-SA-20:05.if_oce_ioctl" date = "2020-03-19" [[advisories]] name = "FreeBSD-SA-20:04.tcp" date = "2020-03-19" [[advisories]] name = "FreeBSD-SA-20:03.thrmisc" date = "2020-01-28" [[advisories]] name = "FreeBSD-SA-20:02.ipsec" date = "2020-01-28" [[advisories]] name = "FreeBSD-SA-20:01.libfetch" date = "2020-01-28" [[advisories]] name = "FreeBSD-SA-19:26.mcu" date = "2019-11-12" [[advisories]] name = "FreeBSD-SA-19:25.mcepsc" date = "2019-11-12" [[advisories]] name = "FreeBSD-SA-19:24.mqueuefs" date = "2019-08-20" [[advisories]] name = "FreeBSD-SA-19:23.midi" date = "2019-08-20" [[advisories]] name = "FreeBSD-SA-19:22.mbuf" date = "2019-08-20" [[advisories]] name = "FreeBSD-SA-19:21.bhyve" date = "2019-08-06" [[advisories]] name = "FreeBSD-SA-19:20.bsnmp" date = "2019-08-06" [[advisories]] name = "FreeBSD-SA-19:19.mldv2" date = "2019-08-06" [[advisories]] name = "FreeBSD-SA-19:18.bzip2" date = "2019-08-06" [[advisories]] name = "FreeBSD-SA-19:17.fd" date = "2019-07-24" [[advisories]] name = "FreeBSD-SA-19:16.bhyve" date = "2019-07-24" [[advisories]] name = "FreeBSD-SA-19:15.mqueuefs" date = "2019-07-24" [[advisories]] name = "FreeBSD-SA-19:14.freebsd32" date = "2019-07-24" [[advisories]] name = "FreeBSD-SA-19:13.pts" date = "2019-07-24" [[advisories]] name = "FreeBSD-SA-19:12.telnet" date = "2019-07-24" [[advisories]] name = "FreeBSD-SA-19:11.cd_ioctl" date = "2019-07-02" [[advisories]] name = "FreeBSD-SA-19:10.ufs" date = "2019-07-02" [[advisories]] name = "FreeBSD-SA-19:09.iconv" date = "2019-07-02" [[advisories]] name = "FreeBSD-SA-19:08.rack" date = "2019-06-19" [[advisories]] name = "FreeBSD-SA-19:07.mds" date = "2019-05-14" [[advisories]] name = "FreeBSD-SA-19:06.pf" date = "2019-05-14" [[advisories]] name = "FreeBSD-SA-19:05.pf" date = "2019-05-14" [[advisories]] name = "FreeBSD-SA-19:04.ntp" date = "2019-05-14" [[advisories]] name = "FreeBSD-SA-19:03.wpa" date = "2019-05-14" [[advisories]] name = "FreeBSD-SA-19:02.fd" date = "2019-02-05" [[advisories]] name = "FreeBSD-SA-19:01.syscall" date = "2019-02-05" [[advisories]] name = "FreeBSD-SA-18:15.bootpd" date = "2018-12-19" [[advisories]] name = "FreeBSD-SA-18:14.bhyve" date = "2018-12-04" [[advisories]] name = "FreeBSD-SA-18:13.nfs" date = "2018-11-27" [[advisories]] name = "FreeBSD-SA-18:12.elf" date = "2018-09-12" [[advisories]] name = "FreeBSD-SA-18:11.hostapd" date = "2018-08-14" [[advisories]] name = "FreeBSD-SA-18:10.ip" date = "2018-08-14" [[advisories]] name = "FreeBSD-SA-18:09.l1tf" date = "2018-08-14" [[advisories]] name = "FreeBSD-SA-18:08.tcp" date = "2018-08-06" [[advisories]] name = "FreeBSD-SA-18:07.lazyfpu" date = "2018-06-21" [[advisories]] name = "FreeBSD-SA-18:06.debugreg" date = "2018-05-08" [[advisories]] name = "FreeBSD-SA-18:05.ipsec" date = "2018-04-04" [[advisories]] name = "FreeBSD-SA-18:04.vt" date = "2018-04-04" [[advisories]] name = "FreeBSD-SA-18:03.speculative_execution" date = "2018-03-14" [[advisories]] name = "FreeBSD-SA-18:02.ntp" date = "2018-03-07" [[advisories]] name = "FreeBSD-SA-18:01.ipsec" date = "2018-03-07" [[advisories]] name = "FreeBSD-SA-17:12.openssl" date = "2017-12-09" [[advisories]] name = "FreeBSD-SA-17:11.openssl" date = "2017-11-29" [[advisories]] name = "FreeBSD-SA-17:10.kldstat" date = "2017-11-15" [[advisories]] name = "FreeBSD-SA-17:09.shm" date = "2017-11-15" [[advisories]] name = "FreeBSD-SA-17:08.ptrace" date = "2017-11-15" [[advisories]] name = "FreeBSD-SA-17:07.wpa" date = "2017-10-17" [[advisories]] name = "FreeBSD-SA-17:06.openssh" date = "2017-08-10" [[advisories]] name = "FreeBSD-SA-17:05.heimdal" date = "2017-07-12" [[advisories]] name = "FreeBSD-SA-17:04.ipfilter" date = "2017-04-27" [[advisories]] name = "FreeBSD-SA-17:03.ntp" date = "2017-04-12" [[advisories]] name = "FreeBSD-SA-17:02.openssl" date = "2017-02-23" [[advisories]] name = "FreeBSD-SA-17:01.openssh" date = "2017-01-11" [[advisories]] name = "FreeBSD-SA-16:39.ntp" date = "2016-12-22" [[advisories]] name = "FreeBSD-SA-16:38.bhyve" date = "2016-12-06" [[advisories]] name = "FreeBSD-SA-16:37.libc" date = "2016-12-06" [[advisories]] name = "FreeBSD-SA-16:36.telnetd" date = "2016-12-06" [[advisories]] name = "FreeBSD-SA-16:35.openssl" date = "2016-11-02" [[advisories]] name = "FreeBSD-SA-16:34.bind" date = "2016-11-02" [[advisories]] name = "FreeBSD-SA-16:33.openssh" date = "2016-11-02" [[advisories]] name = "FreeBSD-SA-16:32.bhyve" date = "2016-10-25" [[advisories]] name = "FreeBSD-SA-16:31.libarchive" date = "2016-10-10" [[advisories]] name = "FreeBSD-SA-16:30.portsnap" date = "2016-10-10" [[advisories]] name = "FreeBSD-SA-16:29.bspatch" date = "2016-10-10" [[advisories]] name = "FreeBSD-SA-16:28.bind" date = "2016-10-10" [[advisories]] name = "FreeBSD-SA-16:27.openssl" date = "2016-10-10" [[advisories]] name = "FreeBSD-SA-16:26.openssl" date = "2016-09-23" [[advisories]] name = "FreeBSD-SA-16:25.bspatch" date = "2016-07-25" [[advisories]] name = "FreeBSD-SA-16:24.ntp" date = "2016-06-04" [[advisories]] name = "FreeBSD-SA-16:23.libarchive" date = "2016-05-31" [[advisories]] name = "FreeBSD-SA-16:22.libarchive" date = "2016-05-31" [[advisories]] name = "FreeBSD-SA-16:21.43bsd" date = "2016-05-31" [[advisories]] name = "FreeBSD-SA-16:20.linux" date = "2016-05-31" [[advisories]] name = "FreeBSD-SA-16:19.sendmsg" date = "2016-05-17" [[advisories]] name = "FreeBSD-SA-16:18.atkbd" date = "2016-05-17" [[advisories]] name = "FreeBSD-SA-16:17.openssl" date = "2016-05-04" [[advisories]] name = "FreeBSD-SA-16:16.ntp" date = "2016-04-29" [[advisories]] name = "FreeBSD-SA-16:15.sysarch" date = "2016-03-16" [[advisories]] name = "FreeBSD-SA-16:14.openssh" date = "2016-03-16" [[advisories]] name = "FreeBSD-SA-16:13.bind" date = "2016-03-10" [[advisories]] name = "FreeBSD-SA-16:12.openssl" date = "2016-03-10" [[advisories]] name = "FreeBSD-SA-16:11.openssl" date = "2016-01-30" [[advisories]] name = "FreeBSD-SA-16:10.linux" date = "2016-01-27" [[advisories]] name = "FreeBSD-SA-16:09.ntp" date = "2016-01-27" [[advisories]] name = "FreeBSD-SA-16:08.bind" date = "2016-01-27" [[advisories]] name = "FreeBSD-SA-16:07.openssh" date = "2016-01-14" [[advisories]] name = "FreeBSD-SA-16:06.bsnmpd" date = "2016-01-14" [[advisories]] name = "FreeBSD-SA-16:05.tcp" date = "2016-01-14" [[advisories]] name = "FreeBSD-SA-16:04.linux" date = "2016-01-14" [[advisories]] name = "FreeBSD-SA-16:03.linux" date = "2016-01-14" [[advisories]] name = "FreeBSD-SA-16:02.ntp" date = "2016-01-14" [[advisories]] name = "FreeBSD-SA-16:01.sctp" date = "2016-01-14" [[advisories]] name = "FreeBSD-SA-15:27.bind" date = "2015-12-16" [[advisories]] name = "FreeBSD-SA-15:26.openssl" date = "2015-12-06" [[advisories]] name = "FreeBSD-SA-15:25.ntp" date = "2015-10-26" [[advisories]] name = "FreeBSD-SA-15:24.rpcbind" date = "2015-09-29" [[advisories]] name = "FreeBSD-SA-15:23.bind" date = "2015-09-02" [[advisories]] name = "FreeBSD-SA-15:22.openssh" date = "2015-08-25" [[advisories]] name = "FreeBSD-SA-15:21.amd64" date = "2015-08-25" [[advisories]] name = "FreeBSD-SA-15:20.expat" date = "2015-08-18" [[advisories]] name = "FreeBSD-SA-15:19.routed" date = "2015-08-05" [[advisories]] name = "FreeBSD-SA-15:18.bsdpatch" date = "2015-08-05" [[advisories]] name = "FreeBSD-SA-15:17.bind" date = "2015-07-28" [[advisories]] name = "FreeBSD-SA-15:16.openssh" date = "2015-07-28" [[advisories]] name = "FreeBSD-SA-15:15.tcp" date = "2015-07-28" [[advisories]] name = "FreeBSD-SA-15:14.bsdpatch" date = "2015-07-28" [[advisories]] name = "FreeBSD-SA-15:13.tcp" date = "2015-07-21" [[advisories]] name = "FreeBSD-SA-15:12.openssl" date = "2015-07-09" [[advisories]] name = "FreeBSD-SA-15:11.bind" date = "2015-07-07" [[advisories]] name = "FreeBSD-SA-15:10.openssl" date = "2015-06-12" [[advisories]] name = "FreeBSD-SA-15:09.ipv6" date = "2015-04-07" [[advisories]] name = "FreeBSD-SA-15:08.bsdinstall" date = "2015-04-07" [[advisories]] name = "FreeBSD-SA-15:07.ntp" date = "2015-04-07" [[advisories]] name = "FreeBSD-SA-15:06.openssl" date = "2015-03-19" [[advisories]] name = "FreeBSD-SA-15:05.bind" date = "2015-02-25" [[advisories]] name = "FreeBSD-SA-15:04.igmp" date = "2015-02-25" [[advisories]] name = "FreeBSD-SA-15:03.sctp" date = "2015-01-27" [[advisories]] name = "FreeBSD-SA-15:02.kmem" date = "2015-01-27" [[advisories]] name = "FreeBSD-SA-15:01.openssl" date = "2015-01-14" [[advisories]] name = "FreeBSD-SA-14:31.ntp" date = "2014-12-23" [[advisories]] name = "FreeBSD-SA-14:30.unbound" date = "2014-12-17" [[advisories]] name = "FreeBSD-SA-14:29.bind" date = "2014-12-10" [[advisories]] name = "FreeBSD-SA-14:28.file" date = "2014-12-10" [[advisories]] name = "FreeBSD-SA-14:27.stdio" date = "2014-12-10" [[advisories]] name = "FreeBSD-SA-14:26.ftp" date = "2014-11-04" [[advisories]] name = "FreeBSD-SA-14:25.setlogin" date = "2014-11-04" [[advisories]] name = "FreeBSD-SA-14:24.sshd" date = "2014-11-04" [[advisories]] name = "FreeBSD-SA-14:23.openssl" date = "2014-10-21" [[advisories]] name = "FreeBSD-SA-14:22.namei" date = "2014-10-21" [[advisories]] name = "FreeBSD-SA-14:21.routed" date = "2014-10-21" [[advisories]] name = "FreeBSD-SA-14:20.rtsold" date = "2014-10-21" [[advisories]] name = "FreeBSD-SA-14:19.tcp" date = "2014-09-16" [[advisories]] name = "FreeBSD-SA-14:18.openssl" date = "2014-09-09" [[advisories]] name = "FreeBSD-SA-14:17.kmem" date = "2014-07-08" [[advisories]] name = "FreeBSD-SA-14:16.file" date = "2014-06-24" [[advisories]] name = "FreeBSD-SA-14:15.iconv" date = "2014-06-24" [[advisories]] name = "FreeBSD-SA-14:14.openssl" date = "2014-06-05" [[advisories]] name = "FreeBSD-SA-14:13.pam" date = "2014-06-03" [[advisories]] name = "FreeBSD-SA-14:12.ktrace" date = "2014-06-03" [[advisories]] name = "FreeBSD-SA-14:11.sendmail" date = "2014-06-03" [[advisories]] name = "FreeBSD-SA-14:10.openssl" date = "2014-05-13" [[advisories]] name = "FreeBSD-SA-14:09.openssl" date = "2014-04-30" [[advisories]] name = "FreeBSD-SA-14:08.tcp" date = "2014-04-30" [[advisories]] name = "FreeBSD-SA-14:07.devfs" date = "2014-04-30" [[advisories]] name = "FreeBSD-SA-14:06.openssl" date = "2014-04-08" [[advisories]] name = "FreeBSD-SA-14:05.nfsserver" date = "2014-04-08" [[advisories]] name = "FreeBSD-SA-14:04.bind" date = "2014-01-14" [[advisories]] name = "FreeBSD-SA-14:03.openssl" date = "2014-01-14" [[advisories]] name = "FreeBSD-SA-14:02.ntpd" date = "2014-01-14" [[advisories]] name = "FreeBSD-SA-14:01.bsnmpd" date = "2014-01-14" [[advisories]] name = "FreeBSD-SA-13:14.openssh" date = "2013-11-19" [[advisories]] name = "FreeBSD-SA-13:13.nullfs" date = "2013-09-10" [[advisories]] name = "FreeBSD-SA-13:12.ifioctl" date = "2013-09-10" [[advisories]] name = "FreeBSD-SA-13:11.sendfile" date = "2013-09-10" [[advisories]] name = "FreeBSD-SA-13:10.sctp" date = "2013-08-22" [[advisories]] name = "FreeBSD-SA-13:09.ip_multicast" date = "2013-08-22" [[advisories]] name = "FreeBSD-SA-13:08.nfsserver" date = "2013-07-26" [[advisories]] name = "FreeBSD-SA-13:07.bind" date = "2013-07-26" [[advisories]] name = "FreeBSD-SA-13:06.mmap" date = "2013-06-18" [[advisories]] name = "FreeBSD-SA-13:05.nfsserver" date = "2013-04-29" [[advisories]] name = "FreeBSD-SA-13:04.bind" date = "2013-04-02" [[advisories]] name = "FreeBSD-SA-13:03.openssl" date = "2013-04-02" [[advisories]] name = "FreeBSD-SA-13:02.libc" date = "2013-02-19" [[advisories]] name = "FreeBSD-SA-13:01.bind" date = "2013-02-19" [[advisories]] name = "FreeBSD-SA-12:08.linux" date = "2012-11-22" [[advisories]] name = "FreeBSD-SA-12:07.hostapd" date = "2012-11-22" [[advisories]] name = "FreeBSD-SA-12:06.bind" date = "2012-11-22" [[advisories]] name = "FreeBSD-SA-12:05.bind" date = "2012-08-06" [[advisories]] name = "FreeBSD-SA-12:04.sysret" date = "2012-06-12" [[advisories]] name = "FreeBSD-SA-12:03.bind" date = "2012-06-12" [[advisories]] name = "FreeBSD-SA-12:02.crypt" date = "2012-05-30" [[advisories]] name = "FreeBSD-SA-12:01.openssl" date = "2012-05-30" [[advisories]] name = "FreeBSD-SA-11:10.pam" date = "2011-12-23" [[advisories]] name = "FreeBSD-SA-11:09.pam_ssh" date = "2011-12-23" [[advisories]] name = "FreeBSD-SA-11:08.telnetd" date = "2011-12-23" [[advisories]] name = "FreeBSD-SA-11:07.chroot" date = "2011-12-23" [[advisories]] name = "FreeBSD-SA-11:06.bind" date = "2011-12-23" [[advisories]] name = "FreeBSD-SA-11:05.unix" date = "2011-09-28" [[advisories]] name = "FreeBSD-SA-11:04.compress" date = "2011-09-28" [[advisories]] name = "FreeBSD-SA-11:03.bind" date = "2011-09-28" [[advisories]] name = "FreeBSD-SA-11:02.bind" date = "2011-05-28" [[advisories]] name = "FreeBSD-SA-11:01.mountd" date = "2011-04-20" [[advisories]] name = "FreeBSD-SA-10:10.openssl" date = "2010-11-29" [[advisories]] name = "FreeBSD-SA-10:09.pseudofs" date = "2010-11-10" [[advisories]] name = "FreeBSD-SA-10:08.bzip2" date = "2010-09-20" [[advisories]] name = "FreeBSD-SA-10:07.mbuf" date = "2010-07-13" [[advisories]] name = "FreeBSD-SA-10:06.nfsclient" date = "2010-05-27" [[advisories]] name = "FreeBSD-SA-10:05.opie" date = "2010-05-27" [[advisories]] name = "FreeBSD-SA-10:04.jail" date = "2010-05-27" [[advisories]] name = "FreeBSD-SA-10:03.zfs" date = "2010-01-06" [[advisories]] name = "FreeBSD-SA-10:02.ntpd" date = "2010-01-06" [[advisories]] name = "FreeBSD-SA-10:01.bind" date = "2010-01-06" [[advisories]] name = "FreeBSD-SA-09:17.freebsd-update" date = "2009-12-03" [[advisories]] name = "FreeBSD-SA-09:16.rtld" date = "2009-12-03" [[advisories]] name = "FreeBSD-SA-09:15.ssl" date = "2009-12-03" [[advisories]] name = "FreeBSD-SA-09:14.devfs" date = "2009-10-02" [[advisories]] name = "FreeBSD-SA-09:13.pipe" date = "2009-10-02" [[advisories]] name = "FreeBSD-SA-09:12.bind" date = "2009-07-29" [[advisories]] name = "FreeBSD-SA-09:11.ntpd" date = "2009-06-10" [[advisories]] name = "FreeBSD-SA-09:10.ipv6" date = "2009-06-10" [[advisories]] name = "FreeBSD-SA-09:09.pipe" date = "2009-06-10" [[advisories]] name = "FreeBSD-SA-09:08.openssl" date = "2009-04-22" [[advisories]] name = "FreeBSD-SA-09:07.libc" date = "2009-04-22" [[advisories]] name = "FreeBSD-SA-09:06.ktimer" date = "2009-03-23" [[advisories]] name = "FreeBSD-SA-09:05.telnetd" date = "2009-02-16" [[advisories]] name = "FreeBSD-SA-09:04.bind" date = "2009-01-13" [[advisories]] name = "FreeBSD-SA-09:03.ntpd" date = "2009-01-13" [[advisories]] name = "FreeBSD-SA-09:02.openssl" date = "2009-01-07" [[advisories]] name = "FreeBSD-SA-09:01.lukemftpd" date = "2009-01-07" [[advisories]] name = "FreeBSD-SA-08:13.protosw" date = "2008-12-23" [[advisories]] name = "FreeBSD-SA-08:12.ftpd" date = "2008-12-23" [[advisories]] name = "FreeBSD-SA-08:11.arc4random" date = "2008-11-24" [[advisories]] name = "FreeBSD-SA-08:10.nd6" date = "2008-10-02" [[advisories]] name = "FreeBSD-SA-08:09.icmp6" date = "2008-09-03" [[advisories]] name = "FreeBSD-SA-08:08.nmount" date = "2008-09-03" [[advisories]] name = "FreeBSD-SA-08:07.amd64" date = "2008-09-03" [[advisories]] name = "FreeBSD-SA-08:06.bind" date = "2008-07-13" [[advisories]] name = "FreeBSD-SA-08:05.openssh" date = "2008-04-17" [[advisories]] name = "FreeBSD-SA-08:04.ipsec" date = "2008-02-14" [[advisories]] name = "FreeBSD-SA-08:03.sendfile" date = "2008-02-14" [[advisories]] name = "FreeBSD-SA-08:02.libc" date = "2008-01-14" [[advisories]] name = "FreeBSD-SA-08:01.pty" date = "2008-01-14" [[advisories]] name = "FreeBSD-SA-07:10.gtar" date = "2007-11-29" [[advisories]] name = "FreeBSD-SA-07:09.random" date = "2007-11-29" [[advisories]] name = "FreeBSD-SA-07:08.openssl" date = "2007-10-03" [[advisories]] name = "FreeBSD-SA-07:07.bind" date = "2007-08-01" [[advisories]] name = "FreeBSD-SA-07:06.tcpdump" date = "2007-08-01" [[advisories]] name = "FreeBSD-SA-07:05.libarchive" date = "2007-07-12" [[advisories]] name = "FreeBSD-SA-07:04.file" date = "2007-05-23" [[advisories]] name = "FreeBSD-SA-07:03.ipv6" date = "2007-04-26" [[advisories]] name = "FreeBSD-SA-07:02.bind" date = "2007-02-09" [[advisories]] name = "FreeBSD-SA-07:01.jail" date = "2007-01-11" [[advisories]] name = "FreeBSD-SA-06:26.gtar" date = "2006-12-06" [[advisories]] name = "FreeBSD-SA-06:25.kmem" date = "2006-12-06" [[advisories]] name = "FreeBSD-SA-06:24.libarchive" date = "2006-11-08" [[advisories]] name = "FreeBSD-SA-06:22.openssh" date = "2006-09-30" [[advisories]] name = "FreeBSD-SA-06:23.openssl" date = "2006-09-28" [[advisories]] name = "FreeBSD-SA-06:21.gzip" date = "2006-09-19" [[advisories]] name = "FreeBSD-SA-06:20.bind" date = "2006-09-06" [[advisories]] name = "FreeBSD-SA-06:19.openssl" date = "2006-09-06" [[advisories]] name = "FreeBSD-SA-06:18.ppp" date = "2006-08-23" [[advisories]] name = "FreeBSD-SA-06:17.sendmail" date = "2006-06-14" [[advisories]] name = "FreeBSD-SA-06:16.smbfs" date = "2006-05-31" [[advisories]] name = "FreeBSD-SA-06:15.ypserv" date = "2006-05-31" [[advisories]] name = "FreeBSD-SA-06:14.fpu" date = "2006-04-19" [[advisories]] name = "FreeBSD-SA-06:13.sendmail" date = "2006-03-22" [[advisories]] name = "FreeBSD-SA-06:12.opie" date = "2006-03-22" [[advisories]] name = "FreeBSD-SA-06:11.ipsec" date = "2006-03-22" [[advisories]] name = "FreeBSD-SA-06:10.nfs" date = "2006-03-01" [[advisories]] name = "FreeBSD-SA-06:09.openssh" date = "2006-03-01" [[advisories]] name = "FreeBSD-SA-06:08.sack" date = "2006-02-01" [[advisories]] name = "FreeBSD-SA-06:07.pf" date = "2006-01-25" [[advisories]] name = "FreeBSD-SA-06:06.kmem" date = "2006-01-25" [[advisories]] name = "FreeBSD-SA-06:05.80211" date = "2006-01-18" [[advisories]] name = "FreeBSD-SA-06:04.ipfw" date = "2006-01-11" [[advisories]] name = "FreeBSD-SA-06:03.cpio" date = "2006-01-11" [[advisories]] name = "FreeBSD-SA-06:02.ee" date = "2006-01-11" [[advisories]] name = "FreeBSD-SA-06:01.texindex" date = "2006-01-11" [[advisories]] name = "FreeBSD-SA-05:21.openssl" date = "2005-10-11" [[advisories]] name = "FreeBSD-SA-05:20.cvsbug" date = "2005-09-07" [[advisories]] name = "FreeBSD-SA-05:19.ipsec" date = "2005-07-27" [[advisories]] name = "FreeBSD-SA-05:18.zlib" date = "2005-07-27" [[advisories]] name = "FreeBSD-SA-05:17.devfs" date = "2005-07-20" [[advisories]] name = "FreeBSD-SA-05:16.zlib" date = "2005-07-06" [[advisories]] name = "FreeBSD-SA-05:15.tcp" date = "2005-06-29" [[advisories]] name = "FreeBSD-SA-05:14.bzip2" date = "2005-06-29" [[advisories]] name = "FreeBSD-SA-05:13.ipfw" date = "2005-06-29" [[advisories]] name = "FreeBSD-SA-05:12.bind9" date = "2005-06-09" [[advisories]] name = "FreeBSD-SA-05:11.gzip" date = "2005-06-09" [[advisories]] name = "FreeBSD-SA-05:10.tcpdump" date = "2005-06-09" [[advisories]] name = "FreeBSD-SA-05:09.htt" date = "2005-05-13" [[advisories]] name = "FreeBSD-SA-05:08.kmem" date = "2005-05-06" [[advisories]] name = "FreeBSD-SA-05:07.ldt" date = "2005-05-06" [[advisories]] name = "FreeBSD-SA-05:06.iir" date = "2005-05-06" [[advisories]] name = "FreeBSD-SA-05:05.cvs" date = "2005-04-22" [[advisories]] name = "FreeBSD-SA-05:04.ifconf" date = "2005-04-15" [[advisories]] name = "FreeBSD-SA-05:03.amd64" date = "2005-04-06" [[advisories]] name = "FreeBSD-SA-05:02.sendfile" date = "2005-04-04" [[advisories]] name = "FreeBSD-SA-05:01.telnet" date = "2005-03-28" [[advisories]] name = "FreeBSD-SA-04:17.procfs" date = "2004-12-01" [[advisories]] name = "FreeBSD-SA-04:16.fetch" date = "2004-11-18" [[advisories]] name = "FreeBSD-SA-04:15.syscons" date = "2004-10-04" [[advisories]] name = "FreeBSD-SA-04:14.cvs" date = "2004-09-19" [[advisories]] name = "FreeBSD-SA-04:13.linux" date = "2004-06-30" [[advisories]] name = "FreeBSD-SA-04:12.jailroute" date = "2004-06-07" [[advisories]] name = "FreeBSD-SA-04:11.msync" date = "2004-05-19" [[advisories]] name = "FreeBSD-SA-04:10.cvs" date = "2004-05-19" [[advisories]] name = "FreeBSD-SA-04:09.kadmind" date = "2004-05-05" [[advisories]] name = "FreeBSD-SA-04:08.heimdal" date = "2004-05-05" [[advisories]] name = "FreeBSD-SA-04:07.cvs" date = "2004-04-15" [[advisories]] name = "FreeBSD-SA-04:06.ipv6" date = "2004-03-29" [[advisories]] name = "FreeBSD-SA-04:05.openssl" date = "2004-03-17" [[advisories]] name = "FreeBSD-SA-04:04.tcp" date = "2004-03-02" [[advisories]] name = "FreeBSD-SA-04:03.jail" date = "2004-02-25" [[advisories]] name = "FreeBSD-SA-04:02.shmat" date = "2004-02-05" [[advisories]] name = "FreeBSD-SA-04:01.mksnap_ffs" date = "2004-01-30" [[advisories]] name = "FreeBSD-SA-03:19.bind" date = "2003-11-28" [[advisories]] name = "FreeBSD-SA-03:15.openssh" date = "2003-10-05" [[advisories]] name = "FreeBSD-SA-03:18.openssl" date = "2003-10-03" [[advisories]] name = "FreeBSD-SA-03:17.procfs" date = "2003-10-03" [[advisories]] name = "FreeBSD-SA-03:16.filedesc" date = "2003-10-02" [[advisories]] name = "FreeBSD-SA-03:14.arp" date = "2003-09-23" [[advisories]] name = "FreeBSD-SA-03:13.sendmail" date = "2003-09-17" [[advisories]] name = "FreeBSD-SA-03:12.openssh" date = "2003-09-16" [[advisories]] name = "FreeBSD-SA-03:11.sendmail" date = "2003-08-26" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/1170" [[advisories]] name = "FreeBSD-SA-03:10.ibcs2" date = "2003-08-10" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/1164" [[advisories]] name = "FreeBSD-SA-03:09.signal" date = "2003-08-10" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/1163" [[advisories]] name = "FreeBSD-SA-03:08.realpath" date = "2003-08-03" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/1158" [[advisories]] name = "FreeBSD-SN-03:02" date = "2003-04-08" [[advisories]] name = "FreeBSD-SN-03:01" date = "2003-04-07" [[advisories]] name = "FreeBSD-SA-03:07.sendmail" date = "2003-03-30" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/1122" [[advisories]] name = "FreeBSD-SA-03:06.openssl" date = "2003-03-21" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/1118" [[advisories]] name = "FreeBSD-SA-03:05.xdr" date = "2003-03-20" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/1117" [[advisories]] name = "FreeBSD-SA-03:04.sendmail" date = "2003-03-03" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/1112" [[advisories]] name = "FreeBSD-SA-03:03.syncookies" date = "2003-02-24" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/1106" [[advisories]] name = "FreeBSD-SA-03:02.openssl" date = "2003-02-24" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/1105" [[advisories]] name = "FreeBSD-SA-03:01.cvs" date = "2003-02-04" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/1100" [[advisories]] name = "FreeBSD-SA-02:44.filedesc" date = "2003-01-07" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/1090" [[advisories]] name = "FreeBSD-SA-02:43.bind" date = "2002-11-15" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/1084" [[advisories]] name = "FreeBSD-SA-02:41.smrsh" date = "2002-11-15" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/1082" [[advisories]] name = "FreeBSD-SA-02:42.resolv" date = "2002-11-12" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/1083" [[advisories]] name = "FreeBSD-SA-02:40.kadmind" date = "2002-11-12" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/1081" [[advisories]] name = "FreeBSD-SN-02:06" date = "2002-10-10" [[advisories]] name = "FreeBSD-SA-02:39.libkvm" date = "2002-09-16" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/1051" [[advisories]] name = "FreeBSD-SN-02:05" date = "2002-08-28" [[advisories]] name = "FreeBSD-SA-02:38.signed-error" date = "2002-08-19" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/1041" [[advisories]] name = "FreeBSD-SA-02:37.kqueue" date = "2002-08-05" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/1033" [[advisories]] name = "FreeBSD-SA-02:36.nfs" date = "2002-08-05" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/1032" [[advisories]] name = "FreeBSD-SA-02:35.ffs" date = "2002-08-05" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/1031" [[advisories]] name = "FreeBSD-SA-02:33.openssl" date = "2002-08-05" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/1023" [[advisories]] name = "FreeBSD-SA-02:34.rpc" date = "2002-08-01" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/1024" [[advisories]] name = "FreeBSD-SA-02:32.pppd" date = "2002-07-31" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/1022" [[advisories]] name = "FreeBSD-SA-02:31.openssh" date = "2002-07-15" [[advisories]] name = "FreeBSD-SA-02:30.ktrace" date = "2002-07-12" [[advisories]] name = "FreeBSD-SA-02:29.tcpdump" date = "2002-07-12" [[advisories]] name = "FreeBSD-SA-02:28.resolv" date = "2002-06-26" [[advisories]] name = "FreeBSD-SN-02:04" date = "2002-06-19" [[advisories]] name = "FreeBSD-SA-02:27.rc" date = "2002-05-29" [[advisories]] name = "FreeBSD-SA-02:26.accept" date = "2002-05-29" [[advisories]] name = "FreeBSD-SN-02:03" date = "2002-05-28" [[advisories]] name = "FreeBSD-SA-02:25.bzip2" date = "2002-05-20" [[advisories]] name = "FreeBSD-SA-02:24.k5su" date = "2002-05-20" [[advisories]] name = "FreeBSD-SN-02:02" date = "2002-05-13" [[advisories]] name = "FreeBSD-SA-02:23.stdio" date = "2002-04-22" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/1021" [[advisories]] name = "FreeBSD-SA-02:22.mmap" date = "2002-04-18" [[advisories]] name = "FreeBSD-SA-02:21.tcpip" date = "2002-04-17" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/980" [[advisories]] name = "FreeBSD-SA-02:20.syncache" date = "2002-04-16" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/979" [[advisories]] name = "FreeBSD-SN-02:01" date = "2002-03-30" [[advisories]] name = "FreeBSD-SA-02:19.squid" date = "2002-03-26" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/960" [[advisories]] name = "FreeBSD-SA-02:18.zlib" date = "2002-03-18" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/978" [[advisories]] name = "FreeBSD-SA-02:17.mod_frontpage" date = "2002-03-12" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/954" [[advisories]] name = "FreeBSD-SA-02:16.netscape" date = "2002-03-12" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/953" [[advisories]] name = "FreeBSD-SA-02:15.cyrus-sasl" date = "2002-03-12" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/952" [[advisories]] name = "FreeBSD-SA-02:14.pam-pgsql" date = "2002-03-12" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/951" [[advisories]] name = "FreeBSD-SA-02:13.openssh" date = "2002-03-07" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/945" [[advisories]] name = "FreeBSD-SA-02:12.squid" date = "2002-02-21" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/938" [[advisories]] name = "FreeBSD-SA-02:11.snmp" date = "2002-02-12" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/936" [[advisories]] name = "FreeBSD-SA-02:10.rsync" date = "2002-02-06" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/928" [[advisories]] name = "FreeBSD-SA-02:09.fstatfs" date = "2002-02-06" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/927" [[advisories]] name = "FreeBSD-SA-02:08.exec" date = "2002-01-24" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/923" [[advisories]] name = "FreeBSD-SA-02:07.k5su" date = "2002-01-18" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/912" [[advisories]] name = "FreeBSD-SA-02:06.sudo" date = "2002-01-16" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/909" [[advisories]] name = "FreeBSD-SA-02:05.pine" date = "2002-01-04" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/894" [[advisories]] name = "FreeBSD-SA-02:04.mutt" date = "2002-01-04" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/893" [[advisories]] name = "FreeBSD-SA-02:03.mod_auth_pgsql" date = "2002-01-04" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/892" [[advisories]] name = "FreeBSD-SA-02:02.pw" date = "2002-01-04" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/891" [[advisories]] name = "FreeBSD-SA-02:01.pkg_add" date = "2002-01-04" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/898" [[advisories]] name = "FreeBSD-SA-01:64.wu-ftpd" date = "2001-12-04" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/870" [[advisories]] name = "FreeBSD-SA-01:63.openssh" date = "2001-12-02" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/871" [[advisories]] name = "FreeBSD-SA-01:62.uucp" date = "2001-10-08" [[advisories]] name = "FreeBSD-SA-01:61.squid" date = "2001-10-08" [[advisories]] name = "FreeBSD-SA-01:60.procmail" date = "2001-09-24" [[advisories]] name = "FreeBSD-SA-01:59.rmuser" date = "2001-09-04" [[advisories]] name = "FreeBSD-SA-01:58.lpd" date = "2001-08-30" [[advisories]] name = "FreeBSD-SA-01:57.sendmail" date = "2001-08-27" [[advisories]] name = "FreeBSD-SA-01:56.tcp_wrappers" date = "2001-08-23" [[advisories]] name = "FreeBSD-SA-01:55.procfs" date = "2001-08-21" [[advisories]] name = "FreeBSD-SA-01:54.ports-telnetd" date = "2001-08-20" [[advisories]] name = "FreeBSD-SA-01:53.ipfw" date = "2001-08-17" [[advisories]] name = "FreeBSD-SA-01:52.fragment" date = "2001-08-06" [[advisories]] name = "FreeBSD-SA-01:51.openssl" date = "2001-07-30" [[advisories]] name = "FreeBSD-SA-01:50.windowmaker" date = "2001-07-27" [[advisories]] name = "FreeBSD-SA-01:49.telnetd" date = "2001-07-23" [[advisories]] name = "FreeBSD-SA-01:48.tcpdump" date = "2001-07-17" [[advisories]] name = "FreeBSD-SA-01:47.xinetd" date = "2001-07-10" [[advisories]] name = "FreeBSD-SA-01:46.w3m" date = "2001-07-10" [[advisories]] name = "FreeBSD-SA-01:45.samba" date = "2001-07-10" [[advisories]] name = "FreeBSD-SA-01:44.gnupg" date = "2001-07-10" [[advisories]] name = "FreeBSD-SA-01:43.fetchmail" date = "2001-07-10" [[advisories]] name = "FreeBSD-SA-01:42.signal" date = "2001-07-10" [[advisories]] name = "FreeBSD-SA-01:41.hanterm" date = "2001-07-09" [[advisories]] name = "FreeBSD-SA-01:40.fts" date = "2001-06-04" [[advisories]] name = "FreeBSD-SA-01:39.tcp-isn" date = "2001-05-02" [[advisories]] name = "FreeBSD-SA-01:38.sudo" date = "2001-04-23" [[advisories]] name = "FreeBSD-SA-01:37.slrn" date = "2001-04-23" [[advisories]] name = "FreeBSD-SA-01:36.samba" date = "2001-04-23" [[advisories]] name = "FreeBSD-SA-01:35.licq" date = "2001-04-23" [[advisories]] name = "FreeBSD-SA-01:34.hylafax" date = "2001-04-23" [[advisories]] name = "FreeBSD-SA-01:33.ftpd-glob" date = "2001-04-17" [[advisories]] name = "FreeBSD-SA-01:32.ipfilter" date = "2001-04-16" [[advisories]] name = "FreeBSD-SA-01:31.ntpd" date = "2001-04-06" [[advisories]] name = "FreeBSD-SA-01:30.ufs-ext2fs" date = "2001-03-22" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/738" [[advisories]] name = "FreeBSD-SA-01:29.rwhod" date = "2001-03-12" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/732" [[advisories]] name = "FreeBSD-SA-01:28.timed" date = "2001-03-12" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/731" [[advisories]] name = "FreeBSD-SA-01:27.cfengine" date = "2001-03-12" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/730" [[advisories]] name = "FreeBSD-SA-01:26.interbase" date = "2001-03-12" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/729" [[advisories]] name = "FreeBSD-SA-01:23.icecast" date = "2001-03-12" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/728" [[advisories]] name = "FreeBSD-SA-01:25.kerberosIV" date = "2001-02-14" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/716" [[advisories]] name = "FreeBSD-SA-01:24.ssh" date = "2001-02-12" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/715" [[advisories]] name = "FreeBSD-SA-01:22.dc20ctrl" date = "2001-02-07" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/714" [[advisories]] name = "FreeBSD-SA-01:21.ja-elvis" date = "2001-02-07" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/713" [[advisories]] name = "FreeBSD-SA-01:20.mars_nwe" date = "2001-02-07" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/712" [[advisories]] name = "FreeBSD-SA-01:19.ja-klock" date = "2001-02-07" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/707" [[advisories]] name = "FreeBSD-SA-01:18.bind" date = "2001-01-31" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/706" [[advisories]] name = "FreeBSD-SA-01:17.exmh" date = "2001-01-29" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/705" [[advisories]] name = "FreeBSD-SA-01:16.mysql" date = "2001-01-29" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/704" [[advisories]] name = "FreeBSD-SA-01:15.tinyproxy" date = "2001-01-29" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/703" [[advisories]] name = "FreeBSD-SA-01:14.micq" date = "2001-01-29" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/702" [[advisories]] name = "FreeBSD-SA-01:13.sort" date = "2001-01-29" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/701" [[advisories]] name = "FreeBSD-SA-01:12.periodic" date = "2001-01-29" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/700" [[advisories]] name = "FreeBSD-SA-01:11.inetd" date = "2001-01-29" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/699" [[advisories]] name = "FreeBSD-SA-01:10.bind" date = "2001-01-23" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/698" [[advisories]] name = "FreeBSD-SA-01:09.crontab" date = "2001-01-23" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/697" [[advisories]] name = "FreeBSD-SA-01:08.ipfw" date = "2001-01-23" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/696" [[advisories]] name = "FreeBSD-SA-01:07.xfree86" date = "2001-01-23" [[advisories]] name = "FreeBSD-SA-01:06.zope" date = "2001-01-15" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/669" [[advisories]] name = "FreeBSD-SA-01:05.stunnel" date = "2001-01-15" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/668" [[advisories]] name = "FreeBSD-SA-01:04.joe" date = "2001-01-15" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/667" [[advisories]] name = "FreeBSD-SA-01:03.bash1" date = "2001-01-15" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/666" [[advisories]] name = "FreeBSD-SA-01:02.syslog-ng" date = "2001-01-15" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/665" [[advisories]] name = "FreeBSD-SA-01:01.openssh" date = "2001-01-15" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/664" [[advisories]] name = "FreeBSD-SA-00:81.ethereal" date = "2000-12-20" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/651" [[advisories]] name = "FreeBSD-SA-00:80.halflifeserver" date = "2000-12-20" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/650" [[advisories]] name = "FreeBSD-SA-00:79.oops" date = "2000-12-20" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/649" [[advisories]] name = "FreeBSD-SA-00:78.bitchx" date = "2000-12-20" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/648" [[advisories]] name = "FreeBSD-SA-00:77.procfs" date = "2000-12-18" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/647" [[advisories]] name = "FreeBSD-SA-00:76.tcsh-csh" date = "2000-11-20" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/628" [[advisories]] name = "FreeBSD-SA-00:75.php" date = "2000-11-20" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/627" [[advisories]] name = "FreeBSD-SA-00:74.gaim" date = "2000-11-20" [[advisories]] name = "FreeBSD-SA-00:73.thttpd" date = "2000-11-20" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/626" [[advisories]] name = "FreeBSD-SA-00:72.curl" date = "2000-11-20" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/625" [[advisories]] name = "FreeBSD-SA-00:71.mgetty" date = "2000-11-20" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/624" [[advisories]] name = "FreeBSD-SA-00:70.ppp-nat" date = "2000-11-14" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/623" [[advisories]] name = "FreeBSD-SA-00:69.telnetd" date = "2000-11-14" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/622" [[advisories]] name = "FreeBSD-SA-00:68.ncurses" date = "2000-11-13" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/621" [[advisories]] name = "FreeBSD-SA-00:67.gnupg" date = "2000-11-10" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/620" [[advisories]] name = "FreeBSD-SA-00:66.netscape" date = "2000-11-06" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/619" [[advisories]] name = "FreeBSD-SA-00:65.xfce" date = "2000-11-06" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/618" [[advisories]] name = "FreeBSD-SA-00:64.global" date = "2000-11-06" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/617" [[advisories]] name = "FreeBSD-SA-00:63.getnameinfo" date = "2000-11-01" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/589" [[advisories]] name = "FreeBSD-SA-00:62.top" date = "2000-11-01" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/616" [[advisories]] name = "FreeBSD-SA-00:61.tcpdump" date = "2000-10-31" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/615" [[advisories]] name = "FreeBSD-SA-00:60.boa" date = "2000-10-30" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/586" [[advisories]] name = "FreeBSD-SA-00:59.pine" date = "2000-10-30" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/585" [[advisories]] name = "FreeBSD-SA-00:58.chpass" date = "2000-10-30" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/584" [[advisories]] name = "FreeBSD-SA-00:57.muh" date = "2000-10-13" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/570" [[advisories]] name = "FreeBSD-SA-00:56.lprng" date = "2000-10-13" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/569" [[advisories]] name = "FreeBSD-SA-00:55.xpdf" date = "2000-10-13" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/568" [[advisories]] name = "FreeBSD-SA-00:54.fingerd" date = "2000-10-13" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/567" [[advisories]] name = "FreeBSD-SA-00:52.tcp-iss" date = "2000-10-06" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/561" [[advisories]] name = "FreeBSD-SA-00:53.catopen" date = "2000-09-27" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/562" [[advisories]] name = "FreeBSD-SA-00:51.mailman" date = "2000-09-13" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/550" [[advisories]] name = "FreeBSD-SA-00:50.listmanager" date = "2000-09-13" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/549" [[advisories]] name = "FreeBSD-SA-00:49.eject" date = "2000-09-13" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/548" [[advisories]] name = "FreeBSD-SA-00:48.xchat" date = "2000-09-13" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/547" [[advisories]] name = "FreeBSD-SA-00:47.pine" date = "2000-09-13" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/546" [[advisories]] name = "FreeBSD-SA-00:46.screen" date = "2000-09-13" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/545" [[advisories]] name = "FreeBSD-SA-00:45.esound" date = "2000-08-31" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/526" [[advisories]] name = "FreeBSD-SA-00:44.xlock" date = "2000-08-28" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/523" [[advisories]] name = "FreeBSD-SA-00:43.brouted" date = "2000-08-28" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/520" [[advisories]] name = "FreeBSD-SA-00:42.linux" date = "2000-08-28" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/530" [[advisories]] name = "FreeBSD-SA-00:41.elf" date = "2000-08-28" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/527" [[advisories]] name = "FreeBSD-SA-00:40.mopd" date = "2000-08-28" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/521" [[advisories]] name = "FreeBSD-SA-00:39.netscape" date = "2000-08-28" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/528" [[advisories]] name = "FreeBSD-SA-00:38.zope" date = "2000-08-14" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/525" [[advisories]] name = "FreeBSD-SA-00:37.cvsweb" date = "2000-08-14" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/524" [[advisories]] name = "FreeBSD-SA-00:36.ntop" date = "2000-08-14" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/531" [[advisories]] name = "FreeBSD-SA-00:35.proftpd" date = "2000-08-14" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/522" [[advisories]] name = "FreeBSD-SA-00:34.dhclient" date = "2000-08-14" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/529" [[advisories]] name = "FreeBSD-SA-00:33.kerberosIV" date = "2000-07-12" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/488" [[advisories]] name = "FreeBSD-SA-00:32.bitchx" date = "2000-07-05" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/487" [[advisories]] name = "FreeBSD-SA-00:31.canna" date = "2000-07-05" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/486" [[advisories]] name = "FreeBSD-SA-00:30.openssh" date = "2000-07-05" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/485" [[advisories]] name = "FreeBSD-SA-00:29.wu-ftpd" date = "2000-07-05" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/489" [[advisories]] name = "FreeBSD-SA-00:28.majordomo" date = "2000-07-05" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/484" [[advisories]] name = "FreeBSD-SA-00:27.XFree86-4" date = "2000-07-05" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/483" [[advisories]] name = "FreeBSD-SA-00:26.popper" date = "2000-07-05" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/482" [[advisories]] name = "FreeBSD-SA-00:24.libedit" date = "2000-07-05" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/481" [[advisories]] name = "FreeBSD-SA-00:23.ip-options" date = "2000-06-19" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/480" [[advisories]] name = "FreeBSD-SA-00:25.alpha-random" date = "2000-06-12" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/473" [[advisories]] name = "FreeBSD-SA-00:22.apsfilter" date = "2000-06-07" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/461" [[advisories]] name = "FreeBSD-SA-00:21.ssh" date = "2000-06-07" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/459" [[advisories]] name = "FreeBSD-SA-00:20.krb5" date = "2000-05-26" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/452" [[advisories]] name = "FreeBSD-SA-00:19.semconfig" date = "2000-05-23" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/451" [[advisories]] name = "FreeBSD-SA-00:18.gnapster.knapster" date = "2000-05-09" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/429" [[advisories]] name = "FreeBSD-SA-00:17.libmytinfo" date = "2000-05-09" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/442" [[advisories]] name = "FreeBSD-SA-00:16.golddig" date = "2000-05-09" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/439" [[advisories]] name = "FreeBSD-SA-00:15.imap-uw" date = "2000-04-24" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/438" [[advisories]] name = "FreeBSD-SA-00:14.imap-uw" date = "2000-04-24" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/441" [[advisories]] name = "FreeBSD-SA-00:13.generic-nqs" date = "2000-04-19" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/437" [[advisories]] name = "FreeBSD-SA-00:12.healthd" date = "2000-04-10" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/436" [[advisories]] name = "FreeBSD-SA-00:11.ircii" date = "2000-04-10" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/440" [[advisories]] name = "FreeBSD-SA-00:10.orville-write" date = "2000-03-15" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/408" [[advisories]] name = "FreeBSD-SA-00:09.mtr" date = "2000-03-15" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/408" [[advisories]] name = "FreeBSD-SA-00:08.lynx" date = "2000-03-15" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/407" [[advisories]] name = "FreeBSD-SA-00:07.mh" date = "2000-03-15" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/411" [[advisories]] name = "FreeBSD-SA-00:06.htdig" date = "2000-03-01" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/403" [[advisories]] name = "FreeBSD-SA-00:05.mysql" date = "2000-02-28" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/402" [[advisories]] name = "FreeBSD-SA-00:04.delegate" date = "2000-02-19" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/392" [[advisories]] name = "FreeBSD-SA-00:03.asmon" date = "2000-02-19" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/391" [[advisories]] name = "FreeBSD-SA-00:02.procfs" date = "2000-01-24" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/380" [[advisories]] name = "FreeBSD-SA-00:01.make" date = "2000-01-19" [[advisories]] name = "FreeBSD-SA-99:06.amd" date = "1999-09-16" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/318" [[advisories]] name = "FreeBSD-SA-99:05.fts" date = "1999-09-15" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/313" [[advisories]] name = "FreeBSD-SA-99:04.core" date = "1999-09-15" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/312" [[advisories]] name = "FreeBSD-SA-99:03.ftpd" date = "1999-09-05" link = "http://home.jp.freebsd.org/cgi-bin/showmail/announce-jp/311" [[advisories]] name = "FreeBSD-SA-99:02.profil" date = "1999-09-04" [[advisories]] name = "FreeBSD-SA-99:01.chflags" date = "1999-09-04" [[advisories]] name = "FreeBSD-SA-98:08.fragment" date = "1998-11-04" [[advisories]] name = "FreeBSD-SA-98:07.rst" date = "1998-10-13" [[advisories]] name = "FreeBSD-SA-98:06.icmp" date = "1998-06-10" [[advisories]] name = "FreeBSD-SA-98:05.nfs" date = "1998-06-04" [[advisories]] name = "FreeBSD-SA-98:04.mmap" date = "1998-06-02" [[advisories]] name = "FreeBSD-SA-98:03.ttcp" date = "1998-05-14" [[advisories]] name = "FreeBSD-SA-98:02.mmap" date = "1998-03-12" [[advisories]] name = "FreeBSD-SA-97:06.f00f" date = "1997-12-09" [[advisories]] name = "FreeBSD-SA-98:01.land" date = "1997-12-01" [[advisories]] name = "FreeBSD-SA-97:05.open" date = "1997-10-29" [[advisories]] name = "FreeBSD-SA-97:04.procfs" date = "1997-08-19" [[advisories]] name = "FreeBSD-SA-97:03.sysinstall" date = "1997-04-07" [[advisories]] name = "FreeBSD-SA-97:02.lpd" date = "1997-03-26" [[advisories]] name = "FreeBSD-SA-97:01.setlocale" date = "1997-02-05" [[advisories]] name = "FreeBSD-SA-96:21.talkd" date = "1997-01-18" [[advisories]] name = "FreeBSD-SA-96:20.stack-overflow" date = "1996-12-16" [[advisories]] name = "FreeBSD-SA-96:19.modstat" date = "1996-12-10" [[advisories]] name = "FreeBSD-SA-96:18.lpr" date = "1996-11-25" [[advisories]] name = "FreeBSD-SA-96:17.rzsz" date = "1996-07-16" [[advisories]] name = "FreeBSD-SA-96:16.rdist" date = "1996-07-12" [[advisories]] name = "FreeBSD-SA-96:15.ppp" date = "1996-07-04" [[advisories]] name = "FreeBSD-SA-96:12.perl" date = "1996-06-28" [[advisories]] name = "FreeBSD-SA-96:14.ipfw" date = "1996-06-24" [[advisories]] name = "FreeBSD-SA-96:13.comsat" date = "1996-06-05" [[advisories]] name = "FreeBSD-SA-96:11.man" date = "1996-05-21" [[advisories]] name = "FreeBSD-SA-96:10.mount_union" date = "1996-05-17" [[advisories]] name = "FreeBSD-SA-96:09.vfsload" date = "1996-05-17" [[advisories]] name = "FreeBSD-SA-96:02.apache" date = "1996-04-22" [[advisories]] name = "FreeBSD-SA-96:08.syslog" date = "1996-04-21" [[advisories]] name = "FreeBSD-SA-96:01.sliplogin" date = "1996-04-21" [[advisories]] name = "FreeBSD-SA-96:03.sendmail-suggestion" date = "1996-04-20" diff --git a/website/data/security/errata.toml b/website/data/security/errata.toml index 63b6c21292..f14683655b 100644 --- a/website/data/security/errata.toml +++ b/website/data/security/errata.toml @@ -1,1083 +1,1095 @@ # Sort errata notices by year, month and day # $FreeBSD$ +[[notices]] +name = "FreeBSD-EN-26:07.pkgbase" +date = "2026-04-21" + +[[notices]] +name = "FreeBSD-EN-26:06.timerfd" +date = "2026-04-21" + +[[notices]] +name = "FreeBSD-EN-26:05.vm" +date = "2026-04-21" + [[notices]] name = "FreeBSD-EN-26:04.arm64" date = "2026-02-10" [[notices]] name = "FreeBSD-EN-26:03.vm" date = "2026-01-27" [[notices]] name = "FreeBSD-EN-26:02.arm64" date = "2026-01-27" [[notices]] name = "FreeBSD-EN-26:01.devinfo" date = "2026-01-27" [[notices]] name = "FreeBSD-EN-25:20.vmm" date = "2025-12-16" [[notices]] name = "FreeBSD-EN-25:19.zfs" date = "2025-12-16" [[notices]] name = "FreeBSD-EN-25:18.freebsd-update" date = "2025-09-30" [[notices]] name = "FreeBSD-EN-25:17.bnxt" date = "2025-09-16" [[notices]] name = "FreeBSD-EN-25:16.vfs" date = "2025-09-16" [[notices]] name = "FreeBSD-EN-25:15.arm64" date = "2025-09-16" [[notices]] name = "FreeBSD-EN-25:14.route" date = "2025-08-08" [[notices]] name = "FreeBSD-EN-25:13.wlan_tkip" date = "2025-08-08" [[notices]] name = "FreeBSD-EN-25:12.efi" date = "2025-08-08" [[notices]] name = "FreeBSD-EN-25:11.ena" date = "2025-07-02" [[notices]] name = "FreeBSD-EN-25:10.zfs" date = "2025-07-02" [[notices]] name = "FreeBSD-EN-25:09.libc" date = "2025-07-02" [[notices]] name = "FreeBSD-EN-25:08.caroot" date = "2025-04-10" [[notices]] name = "FreeBSD-EN-25:07.openssl" date = "2025-04-10" [[notices]] name = "FreeBSD-EN-25:06.daemon" date = "2025-04-10" [[notices]] name = "FreeBSD-EN-25:05.expat" date = "2025-04-10" [[notices]] name = "FreeBSD-EN-25:04.tzdata" date = "2025-04-10" [[notices]] name = "FreeBSD-EN-25:03.tzdata" date = "2025-01-29" [[notices]] name = "FreeBSD-EN-25:02.audit" date = "2025-01-29" [[notices]] name = "FreeBSD-EN-25:01.rpc" date = "2025-01-29" [[notices]] name = "FreeBSD-EN-24:17.pam_xdg" date = "2024-10-29" [[notices]] name = "FreeBSD-EN-24:16.pf" date = "2024-09-19" [[notices]] name = "FreeBSD-EN-24:15.calendar" date = "2024-09-04" [[notices]] name = "FreeBSD-EN-24:14.ifconfig" date = "2024-08-07" [[notices]] name = "FreeBSD-EN-24:13.libc++" date = "2024-06-19" [[notices]] name = "FreeBSD-EN-24:12.killpg" date = "2024-06-19" [[notices]] name = "FreeBSD-EN-24:11.ldns" date = "2024-06-19" [[notices]] name = "FreeBSD-EN-24:10.zfs" date = "2024-06-19" [[notices]] name = "FreeBSD-EN-24:09.zfs" date = "2024-04-24" [[notices]] name = "FreeBSD-EN-24:08.kerberos" date = "2024-03-28" [[notices]] name = "FreeBSD-EN-24:07.clang" date = "2024-03-28" [[notices]] name = "FreeBSD-EN-24:06.wireguard" date = "2024-03-28" [[notices]] name = "FreeBSD-EN-24:05.tty" date = "2024-03-28" [[notices]] name = "FreeBSD-EN-24:04.ip" date = "2024-02-14" [[notices]] name = "FreeBSD-EN-24:03.kqueue" date = "2024-02-14" [[notices]] name = "FreeBSD-EN-24:02.libutil" date = "2024-02-14" [[notices]] name = "FreeBSD-EN-24:01.tzdata" date = "2024-02-14" [[notices]] name = "FreeBSD-EN-23:22.vfs" date = "2023-12-05" [[notices]] name = "FreeBSD-EN-23:21.tty" date = "2023-12-05" [[notices]] name = "FreeBSD-EN-23:20.vm" date = "2023-12-05" [[notices]] name = "FreeBSD-EN-23:19.pkgbase" date = "2023-12-05" [[notices]] name = "FreeBSD-EN-23:18.openzfs" date = "2023-12-05" [[notices]] name = "FreeBSD-EN-23:17.ossl" date = "2023-12-05" [[notices]] name = "FreeBSD-EN-23:16.openzfs" date = "2023-12-01" [[notices]] name = "FreeBSD-EN-23:15.sanitizer" date = "2023-12-01" [[notices]] name = "FreeBSD-EN-23:14.regcomp" date = "2023-11-08" [[notices]] name = "FreeBSD-EN-23:13.freebsd-update" date = "2023-11-08" [[notices]] name = "FreeBSD-EN-23:12.freebsd-update" date = "2023-10-03" [[notices]] name = "FreeBSD-EN-23:11.caroot" date = "2023-09-06" [[notices]] name = "FreeBSD-EN-23:10.pci" date = "2023-09-06" [[notices]] name = "FreeBSD-EN-23:09.freebsd-update" date = "2023-09-06" [[notices]] name = "FreeBSD-EN-23:08.vnet" date = "2023-08-01" [[notices]] name = "FreeBSD-EN-23:07.mpr" date = "2023-06-21" [[notices]] name = "FreeBSD-EN-23:06.loader" date = "2023-06-21" [[notices]] name = "FreeBSD-EN-23:05.tzdata" date = "2023-06-21" [[notices]] name = "FreeBSD-EN-23:04.ixgbe" date = "2023-02-08" [[notices]] name = "FreeBSD-EN-23:03.ena" date = "2023-02-08" [[notices]] name = "FreeBSD-EN-23:02.sdhci" date = "2023-02-08" [[notices]] name = "FreeBSD-EN-23:01.tzdata" date = "2023-02-08" [[notices]] name = "FreeBSD-EN-22:28.heimdal" date = "2022-11-29" [[notices]] name = "FreeBSD-EN-22:27.loader" date = "2022-11-01" [[notices]] name = "FreeBSD-EN-22:26.cam" date = "2022-11-01" [[notices]] name = "FreeBSD-EN-22:25.tcp" date = "2022-11-01" [[notices]] name = "FreeBSD-EN-22:24.zfs" date = "2022-11-01" [[notices]] name = "FreeBSD-EN-22:23.vm" date = "2022-11-01" [[notices]] name = "FreeBSD-EN-22:22.tzdata" date = "2022-11-01" [[notices]] name = "FreeBSD-EN-22:21.zfs" date = "2022-11-01" [[notices]] name = "FreeBSD-EN-22:20.tzdata" date = "2022-08-30" [[notices]] name = "FreeBSD-EN-22:19.pam_exec" date = "2022-08-09" [[notices]] name = "FreeBSD-EN-22:18.wifi" date = "2022-08-09" [[notices]] name = "FreeBSD-EN-22:17.cam" date = "2022-08-09" [[notices]] name = "FreeBSD-EN-22:16.kqueue" date = "2022-08-09" [[notices]] name = "FreeBSD-EN-22:15.pf" date = "2022-04-06" [[notices]] name = "FreeBSD-EN-22:14.tzdata" date = "2022-03-22" [[notices]] name = "FreeBSD-EN-22:13.zfs" date = "2022-03-21" [[notices]] name = "FreeBSD-EN-22:12.zfs" date = "2022-03-15" [[notices]] name = "FreeBSD-EN-22:11.zfs" date = "2022-03-15" [[notices]] name = "FreeBSD-EN-22:10.zfs" date = "2022-03-15" [[notices]] name = "FreeBSD-EN-22:09.freebsd-update" date = "2022-03-15" [[notices]] name = "FreeBSD-EN-22:08.i386" date = "2022-02-01" [[notices]] name = "FreeBSD-EN-22:07.la57" date = "2022-02-01" [[notices]] name = "FreeBSD-EN-22:06.libalias" date = "2022-01-11" [[notices]] name = "FreeBSD-EN-22:05.tail" date = "2022-01-11" [[notices]] name = "FreeBSD-EN-22:04.pcid" date = "2022-01-11" [[notices]] name = "FreeBSD-EN-22:03.hyperv" date = "2022-01-11" [[notices]] name = "FreeBSD-EN-22:02.xsave" date = "2022-01-11" [[notices]] name = "FreeBSD-EN-22:01.fsck_ffs" date = "2022-01-11" [[notices]] name = "FreeBSD-EN-21:29.tzdata" date = "2021-11-03" [[notices]] name = "FreeBSD-EN-21:28.vmci" date = "2021-11-03" [[notices]] name = "FreeBSD-EN-21:27.caroot" date = "2021-11-03" [[notices]] name = "FreeBSD-EN-21:26.libevent" date = "2021-11-03" [[notices]] name = "FreeBSD-EN-21:25.bhyve" date = "2021-08-24" [[notices]] name = "FreeBSD-EN-21:24.libcrypto" date = "2021-08-24" [[notices]] name = "FreeBSD-EN-21:23.virtio_blk" date = "2021-08-24" [[notices]] name = "FreeBSD-EN-21:22.linux_futex" date = "2021-06-29" [[notices]] name = "FreeBSD-EN-21:21.ipfw" date = "2021-06-29" [[notices]] name = "FreeBSD-EN-21:20.vlan" date = "2021-06-29" [[notices]] name = "FreeBSD-EN-21:19.libcasper" date = "2021-06-29" [[notices]] name = "FreeBSD-EN-21:18.libc++" date = "2021-06-29" [[notices]] name = "FreeBSD-EN-21:17.libradius" date = "2021-06-01" [[notices]] name = "FreeBSD-EN-21:16.bc" date = "2021-05-26" [[notices]] name = "FreeBSD-EN-21:15.virtio" date = "2021-05-26" [[notices]] name = "FreeBSD-EN-21:14.pms" date = "2021-05-26" [[notices]] name = "FreeBSD-EN-21:13.mpt" date = "2021-05-26" [[notices]] name = "FreeBSD-EN-21:12.divert" date = "2021-05-26" [[notices]] name = "FreeBSD-EN-21:11.aesni" date = "2021-05-26" [[notices]] name = "FreeBSD-EN-21:10.lldb" date = "2021-04-06" [[notices]] name = "FreeBSD-EN-21:09.pf" date = "2021-04-06" [[notices]] name = "FreeBSD-EN-21:08.freebsd-update" date = "2021-02-24" [[notices]] name = "FreeBSD-EN-21:07.caroot" date = "2021-02-24" [[notices]] name = "FreeBSD-EN-21:06.microcode" date = "2021-02-24" [[notices]] name = "FreeBSD-EN-21:05.libatomic" date = "2021-01-29" [[notices]] name = "FreeBSD-EN-21:04.zfs" date = "2021-01-29" [[notices]] name = "FreeBSD-EN-21:03.vnet" date = "2021-01-29" [[notices]] name = "FreeBSD-EN-21:02.extattr" date = "2021-01-29" [[notices]] name = "FreeBSD-EN-21:01.tzdata" date = "2021-01-29" [[notices]] name = "FreeBSD-EN-20:22.callout" date = "2020-12-01" [[notices]] name = "FreeBSD-EN-20:21.ipfw" date = "2020-12-01" [[notices]] name = "FreeBSD-EN-20:20.tzdata" date = "2020-12-01" [[notices]] name = "FreeBSD-EN-20:19.audit" date = "2020-12-01" [[notices]] name = "FreeBSD-EN-20:18.getfsstat" date = "2020-09-02" [[notices]] name = "FreeBSD-EN-20:17.linuxthread" date = "2020-09-02" [[notices]] name = "FreeBSD-EN-20:16.vmx" date = "2020-08-05" [[notices]] name = "FreeBSD-EN-20:15.mps" date = "2020-07-08" [[notices]] name = "FreeBSD-EN-20:14.linuxkpi" date = "2020-07-08" [[notices]] name = "FreeBSD-EN-20:13.bhyve" date = "2020-07-08" [[notices]] name = "FreeBSD-EN-20:12.iflib" date = "2020-06-09" [[notices]] name = "FreeBSD-EN-20:11.ena" date = "2020-06-09" [[notices]] name = "FreeBSD-EN-20:10.build" date = "2020-05-12" [[notices]] name = "FreeBSD-EN-20:09.igb" date = "2020-05-12" [[notices]] name = "FreeBSD-EN-20:08.tzdata" date = "2020-05-12" [[notices]] name = "FreeBSD-EN-20:07.quotad" date = "2020-04-21" [[notices]] name = "FreeBSD-EN-20:06.ipv6" date = "2020-03-19" [[notices]] name = "FreeBSD-EN-20:05.mlx5en" date = "2020-03-19" [[notices]] name = "FreeBSD-EN-20:04.pfctl" date = "2020-03-19" [[notices]] name = "FreeBSD-EN-20:03.sshd" date = "2020-03-19" [[notices]] name = "FreeBSD-EN-20:02.nmount" date = "2020-01-28" [[notices]] name = "FreeBSD-EN-20:01.ssp" date = "2020-01-28" [[notices]] name = "FreeBSD-EN-19:19.loader" date = "2019-11-12" [[notices]] name = "FreeBSD-EN-19:18.tzdata" date = "2019-10-23" [[notices]] name = "FreeBSD-EN-19:17.ipfw" date = "2019-08-20" [[notices]] name = "FreeBSD-EN-19:16.bhyve" date = "2019-08-20" [[notices]] name = "FreeBSD-EN-19:15.libunwind" date = "2019-08-06" [[notices]] name = "FreeBSD-EN-19:14.epoch" date = "2019-08-06" [[notices]] name = "FreeBSD-EN-19:13.mds" date = "2019-07-24" [[notices]] name = "FreeBSD-EN-19:12.tzdata" date = "2019-07-02" [[notices]] name = "FreeBSD-EN-19:11.net" date = "2019-06-19" [[notices]] name = "FreeBSD-EN-19:10.scp" date = "2019-05-14" [[notices]] name = "FreeBSD-EN-19:09.xinstall" date = "2019-05-14" [[notices]] name = "FreeBSD-EN-19:08.tzdata" date = "2019-05-14" [[notices]] name = "FreeBSD-EN-19:07.lle" date = "2019-02-05" [[notices]] name = "FreeBSD-EN-19:06.dtrace" date = "2019-02-05" [[notices]] name = "FreeBSD-EN-19:05.kqueue" date = "2019-01-09" [[notices]] name = "FreeBSD-EN-19:04.tzdata" date = "2019-01-09" [[notices]] name = "FreeBSD-EN-19:03.sqlite" date = "2019-01-09" [[notices]] name = "FreeBSD-EN-19:02.tcp" date = "2019-01-09" [[notices]] name = "FreeBSD-EN-19:01.cc_cubic" date = "2019-01-09" [[notices]] name = "FreeBSD-EN-18:18.zfs" date = "2018-12-19" [[notices]] name = "FreeBSD-EN-18:17.vm" date = "2018-12-19" [[notices]] name = "FreeBSD-EN-18:16.ptrace" date = "2018-12-19" [[notices]] name = "FreeBSD-EN-18:15.loader" date = "2018-11-27" [[notices]] name = "FreeBSD-EN-18:14.tzdata" date = "2018-11-27" [[notices]] name = "FreeBSD-EN-18:13.icmp" date = "2018-11-27" [[notices]] name = "FreeBSD-EN-18:12.mem" date = "2018-09-27" [[notices]] name = "FreeBSD-EN-18:11.listen" date = "2018-09-27" [[notices]] name = "FreeBSD-EN-18:10.syscall" date = "2018-09-27" [[notices]] name = "FreeBSD-EN-18:09.ip" date = "2018-09-27" [[notices]] name = "FreeBSD-EN-18:08.lazyfpu" date = "2018-09-12" [[notices]] name = "FreeBSD-EN-18:07.pmap" date = "2018-06-21" [[notices]] name = "FreeBSD-EN-18:06.tzdata" date = "2018-05-08" [[notices]] name = "FreeBSD-EN-18:05.mem" date = "2018-05-08" [[notices]] name = "FreeBSD-EN-18:04.mem" date = "2018-04-04" [[notices]] name = "FreeBSD-EN-18:03.tzdata" date = "2018-04-04" [[notices]] name = "FreeBSD-EN-18:02.file" date = "2018-03-07" [[notices]] name = "FreeBSD-EN-18:01.tzdata" date = "2018-03-07" [[notices]] name = "FreeBSD-EN-17:09.tzdata" date = "2017-11-02" [[notices]] name = "FreeBSD-EN-17:08.pf" date = "2017-08-10" [[notices]] name = "FreeBSD-EN-17:07.vnet" date = "2017-08-10" [[notices]] name = "FreeBSD-EN-17:06.hyperv" date = "2017-07-12" [[notices]] name = "FreeBSD-EN-17:05.xen" date = "2017-04-12" [[notices]] name = "FreeBSD-EN-17:04.mandoc" date = "2017-02-23" [[notices]] name = "FreeBSD-EN-17:03.hyperv" date = "2017-02-23" [[notices]] name = "FreeBSD-EN-17:02.yp" date = "2017-02-23" [[notices]] name = "FreeBSD-EN-17:01.pcie" date = "2017-02-23" [[notices]] name = "FreeBSD-EN-16:21.localedef" date = "2016-12-06" [[notices]] name = "FreeBSD-EN-16:20.tzdata" date = "2016-12-06" [[notices]] name = "FreeBSD-EN-16:19.tzcode" date = "2016-12-06" [[notices]] name = "FreeBSD-EN-16:18.loader" date = "2016-10-25" [[notices]] name = "FreeBSD-EN-16:17.vm" date = "2016-10-25" [[notices]] name = "FreeBSD-EN-16:16.hv_storvsc" date = "2016-08-12" [[notices]] name = "FreeBSD-EN-16:15.vmbus" date = "2016-08-12" [[notices]] name = "FreeBSD-EN-16:14.hv_storvsc" date = "2016-08-12" [[notices]] name = "FreeBSD-EN-16:13.vmbus" date = "2016-08-12" [[notices]] name = "FreeBSD-EN-16:12.hv_storvsc" date = "2016-08-12" [[notices]] name = "FreeBSD-EN-16:11.vmbus" date = "2016-08-12" [[notices]] name = "FreeBSD-EN-16:10.dhclient" date = "2016-08-12" [[notices]] name = "FreeBSD-EN-16:09.freebsd-update" date = "2016-07-25" [[notices]] name = "FreeBSD-EN-16:08.zfs" date = "2016-05-04" [[notices]] name = "FreeBSD-EN-16:07.ipi" date = "2016-05-04" [[notices]] name = "FreeBSD-EN-16:06.libc" date = "2016-05-04" [[notices]] name = "FreeBSD-EN-16:05.hv_netvsc" date = "2016-03-16" [[notices]] name = "FreeBSD-EN-16:04.hyperv" date = "2016-03-16" [[notices]] name = "FreeBSD-EN-16:03.yplib" date = "2016-01-14" [[notices]] name = "FreeBSD-EN-16:02.pf" date = "2016-01-14" [[notices]] name = "FreeBSD-EN-16:01.filemon" date = "2016-01-14" [[notices]] name = "FreeBSD-EN-15:20.vm" date = "2015-11-04" [[notices]] name = "FreeBSD-EN-15:19.kqueue" date = "2015-11-04" [[notices]] name = "FreeBSD-EN-15:18.pkg" date = "2015-09-16" [[notices]] name = "FreeBSD-EN-15:17.libc" date = "2015-09-16" [[notices]] name = "FreeBSD-EN-15:16.pw" date = "2015-09-16" [[notices]] name = "FreeBSD-EN-15:15.pkg" date = "2015-08-25" [[notices]] name = "FreeBSD-EN-15:14.ixgbe" date = "2015-08-25" [[notices]] name = "FreeBSD-EN-15:13.vidcontrol" date = "2015-08-18" [[notices]] name = "FreeBSD-EN-15:12.netstat" date = "2015-08-18" [[notices]] name = "FreeBSD-EN-15:11.toolchain" date = "2015-08-18" [[notices]] name = "FreeBSD-EN-15:10.iconv" date = "2015-06-30" [[notices]] name = "FreeBSD-EN-15:09.xlocale" date = "2015-06-30" [[notices]] name = "FreeBSD-EN-15:08.sendmail" date = "2015-06-18" [[notices]] name = "FreeBSD-EN-15:07.zfs" date = "2015-06-09" [[notices]] name = "FreeBSD-EN-15:06.file" date = "2015-06-09" [[notices]] name = "FreeBSD-EN-15:05.ufs" date = "2015-05-13" [[notices]] name = "FreeBSD-EN-15:04.freebsd-update" date = "2015-05-13" [[notices]] name = "FreeBSD-EN-15:03.freebsd-update" date = "2015-02-25" [[notices]] name = "FreeBSD-EN-15:02.openssl" date = "2015-02-25" [[notices]] name = "FreeBSD-EN-15:01.vt" date = "2015-02-25" [[notices]] name = "FreeBSD-EN-14:13.freebsd-update" date = "2014-12-23" [[notices]] name = "FreeBSD-EN-14:12.zfs" date = "2014-11-04" [[notices]] name = "FreeBSD-EN-14:11.crypt" date = "2014-10-22" [[notices]] name = "FreeBSD-EN-14:10.tzdata" date = "2014-10-22" [[notices]] name = "FreeBSD-EN-14:09.jail" date = "2014-07-08" [[notices]] name = "FreeBSD-EN-14:08.heimdal" date = "2014-06-24" [[notices]] name = "FreeBSD-EN-14:07.pmap" date = "2014-06-24" [[notices]] name = "FreeBSD-EN-14:06.exec" date = "2014-06-03" [[notices]] name = "FreeBSD-EN-14:05.ciss" date = "2014-05-13" [[notices]] name = "FreeBSD-EN-14:04.kldxref" date = "2014-05-13" [[notices]] name = "FreeBSD-EN-14:03.pkg" date = "2014-05-13" [[notices]] name = "FreeBSD-EN-14:02.mmap" date = "2014-01-14" [[notices]] name = "FreeBSD-EN-14:01.random" date = "2014-01-14" [[notices]] name = "FreeBSD-EN-13:05.freebsd-update" date = "2013-11-28" [[notices]] name = "FreeBSD-EN-13:04.freebsd-update" date = "2013-10-26" [[notices]] name = "FreeBSD-EN-13:03.mfi" date = "2013-08-22" [[notices]] name = "FreeBSD-EN-13:01.fxp" date = "2013-06-28" [[notices]] name = "FreeBSD-EN-13:02.vtnet" date = "2013-06-28" [[notices]] name = "FreeBSD-EN-12:02.ipv6refcount" date = "2012-06-12" [[notices]] name = "FreeBSD-EN-12:01.freebsd-update" date = "2012-01-04" [[notices]] name = "FreeBSD-EN-10:02.sched_ule" date = "2010-02-27" [[notices]] name = "FreeBSD-EN-10:01.freebsd" date = "2010-01-06" [[notices]] name = "FreeBSD-EN-09:05.null" date = "2009-10-02" [[notices]] name = "FreeBSD-EN-09:04.fork" date = "2009-06-24" [[notices]] name = "FreeBSD-EN-09:03.fxp" date = "2009-06-24" [[notices]] name = "FreeBSD-EN-09:02.bce" date = "2009-06-24" [[notices]] name = "FreeBSD-EN-09:01.kenv" date = "2009-03-23" [[notices]] name = "FreeBSD-EN-08:02.tcp" date = "2008-06-19" [[notices]] name = "FreeBSD-EN-08:01.libpthread" date = "2008-04-17" [[notices]] name = "FreeBSD-EN-07:05.freebsd-update" date = "2007-03-15" [[notices]] name = "FreeBSD-EN-07:04.zoneinfo" date = "2007-02-28" [[notices]] name = "FreeBSD-EN-07:03.rc.d_jail" date = "2007-02-28" [[notices]] name = "FreeBSD-EN-07:02.net" date = "2007-02-28" [[notices]] name = "FreeBSD-EN-07:01.nfs" date = "2007-02-14" [[notices]] name = "FreeBSD-EN-06:02.net" date = "2006-08-28" [[notices]] name = "FreeBSD-EN-06:01.jail" date = "2006-07-07" [[notices]] name = "FreeBSD-EN-05:04.nfs" date = "2005-12-19" [[notices]] name = "FreeBSD-EN-05:03.ipi" date = "2005-01-16" [[notices]] name = "FreeBSD-EN-05:02.sk" date = "2005-01-06" [[notices]] name = "FreeBSD-EN-05:01.nfs" date = "2005-01-05" [[notices]] name = "FreeBSD-EN-04:01.twe" date = "2004-06-28" diff --git a/website/static/security/advisories/FreeBSD-EN-26:05.vm.asc b/website/static/security/advisories/FreeBSD-EN-26:05.vm.asc new file mode 100644 index 0000000000..449b58b25b --- /dev/null +++ b/website/static/security/advisories/FreeBSD-EN-26:05.vm.asc @@ -0,0 +1,158 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +============================================================================= +FreeBSD-EN-26:05.vm Errata Notice + The FreeBSD Project + +Topic: The page fault handler fails to zero memory + +Category: core +Module: vm +Announced: 2026-04-21 +Affects: All supported versions of FreeBSD. +Corrected: 2026-04-13 10:57:44 UTC (stable/15, 15.0-STABLE) + 2026-04-21 15:44:24 UTC (releng/15.0, 15.0-RELEASE-p6) + 2026-04-13 02:56:40 UTC (stable/14, 14.4-STABLE) + 2026-04-21 15:45:29 UTC (releng/14.4, 14.4-RELEASE-p2) + 2026-04-21 15:45:59 UTC (releng/14.3, 14.3-RELEASE-p11) + 2026-04-13 02:58:42 UTC (stable/13, 13.5-STABLE) + 2026-04-21 15:47:06 UTC (releng/13.5, 13.5-RELEASE-p12) + +For general information regarding FreeBSD Errata Notices and Security +Advisories, including descriptions of the fields above, security +branches, and the following sections, please visit +. + +I. Background + +The mmap(2) system call allows applications and system libraries to allocate +heap memory using the MAP_ANON flag. The system call allocates virtual memory +in the calling thread's address space and phyiscal memory is allocated on demand +as page faults occur. Memory allocated this way is allocated to be zero-filled. + +II. Problem Description + +Due to a regression introduced a previous erratum which attempted to fix a +similar problem, under some conditions, particularly heavy memory pressure with +swapping, the phyiscal pages allocated and mapped by the kernel may not be +zero-filled. + +III. Impact + +This bug has been observed to cause process crashes. + +IV. Workaround + +No workaround is available. + +V. Solution + +Upgrade your system to a supported FreeBSD stable or release / security +branch (releng) dated after the correction date, and reboot the system. + +Perform one of the following: + +1) To update your system installed from base system packages: + +Systems running a 15.0-RELEASE version of FreeBSD on the amd64 or arm64 +platforms, which were installed using base system packages, can be updated +via the pkg(8) utility: + +# pkg upgrade -r FreeBSD-base +# shutdown -r now + +2) To update your system installed from binary distribution sets: + +Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms, +or the i386 platform on FreeBSD 13, which were not installed using base +system packages, can be updated via the freebsd-update(8) utility: + +# freebsd-update fetch +# freebsd-update install +# shutdown -r now + +3) To update your system via a source code patch: + +The following patches have been verified to apply to the applicable +FreeBSD release branches. + +a) Download the relevant patch from the location below, and verify the +detached PGP signature using your PGP utility. + +[FreeBSD 15.0] +# fetch https://security.FreeBSD.org/patches/EN-26:05/vm-15.patch +# fetch https://security.FreeBSD.org/patches/EN-26:05/vm-15.patch.asc +# gpg --verify vm-15.patch.asc + +[FreeBSD 14.4 and 14.3] +# fetch https://security.FreeBSD.org/patches/EN-26:05/vm-14.patch +# fetch https://security.FreeBSD.org/patches/EN-26:05/vm-14.patch.asc +# gpg --verify vm-14.patch.asc + +[FreeBSD 13.5] +# fetch https://security.FreeBSD.org/patches/EN-26:05/vm-13.patch +# fetch https://security.FreeBSD.org/patches/EN-26:05/vm-13.patch.asc +# gpg --verify vm-13.patch.asc + +b) Apply the patch. Execute the following commands as root: + +# cd /usr/src +# patch < /path/to/patch + +c) Recompile your kernel as described in + and reboot the +system. + +VI. Correction details + +This issue is corrected as of the corresponding Git commit hash in the +following stable and release branches: + +Branch/path Hash Revision +- ------------------------------------------------------------------------- +stable/15/ 58718cf36593 stable/15-n282974 +releng/15.0/ ffb21713d9fd releng/15.0-n281019 +stable/14/ 9b7c0f4f81f0 stable/14-n273947 +releng/14.4/ 1abe7ead45c3 releng/14.4-n273683 +releng/14.3/ 4d22b3925df8 releng/14.3-n271483 +stable/13/ 50f7b62f0862 stable/13-n259839 +releng/13.5/ 6c9dd7528350 releng/13.5-n259209 +- ------------------------------------------------------------------------- + +Run the following command to see which files were modified by a +particular commit: + +# git show --stat + +Or visit the following URL, replacing NNNNNN with the hash: + + + +To determine the commit count in a working tree (for comparison against +nNNNNNN in the table above), run: + +# git rev-list --count --first-parent HEAD + +VII. References + + + +The latest revision of this advisory is available at + +-----BEGIN PGP SIGNATURE----- + +iQIzBAEBCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmnnoZoACgkQbljekB8A +Gu+Nvg/+Nac6V7x8ELgRlc0dJfzvEeQgxfcu1acAfpr8Bskew+0c8vjwB1dmBAMp +ENDYyI4+kgVFTG+i6KvFVEISTtlji6VWEul4BBgYow93Auk/S492mvOfaQapnW7V +31hjo0jBrT+ZsBW/inRgjy7QQpukqFiz2+aaXjFs8Q426gmW0SizgOFWinVcWaI1 +/xbp5mQ76VnoPMda5+8VDU4NImqcCTUNsUbsfUGLUjYlFhbVR96BODTYIyxB7lsp ++seXVbnk4SdkRwOVXotoCvi2nhnuVc4P3tmUvpmiuOjRQpvAA43VLbgrQJeZjwad +Xda8vzwScbhHZtkrQ5CqInH+4eSLbPYsz3ST1TGKCMh1GwKzQ1b2hqJ52QKHDYbM +NMl5/PhRcfpQNU2dbJqo2X16weowu4N/fSfMPSZrJE7TBdPqBSK/M1bKk/5nBmga +68PLhPPV/q8MbIaf7+19dGO1vsRiM/XpX0IF4XWwURs+ScQCJom1LXX7bQUv+2N/ +i5iPF+JS+PIUsNgwLBz/oR15nyNpZf6kl+ZAKLlZcHdlW1kFHzDW/4DGcIM1Kvx6 +hpwCYx7othSMy6tSxenOM8DLBx2fvvdtxTE+aSRwgnYjxSFquZkN6iSJZ2TP2LnY +koDdRwMajUcxXXB/+RmaoP3/yqK3v156ilntTmolipfMEocGtnE= +=JBjP +-----END PGP SIGNATURE----- diff --git a/website/static/security/advisories/FreeBSD-EN-26:06.timerfd.asc b/website/static/security/advisories/FreeBSD-EN-26:06.timerfd.asc new file mode 100644 index 0000000000..2636dc9aa0 --- /dev/null +++ b/website/static/security/advisories/FreeBSD-EN-26:06.timerfd.asc @@ -0,0 +1,140 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +============================================================================= +FreeBSD-EN-26:06.timerfd Errata Notice + The FreeBSD Project + +Topic: Periodic timerfd(2) timers may produce incorrect results + +Category: core +Module: timerfd +Announced: 2026-04-21 +Affects: FreeBSD 14.3 and later. +Corrected: 2026-04-03 15:26:14 UTC (stable/15, 15.0-STABLE) + 2026-04-21 15:44:25 UTC (releng/15.0, 15.0-RELEASE-p6) + 2026-04-03 15:27:26 UTC (stable/14, 14.4-STABLE) + 2026-04-21 15:45:30 UTC (releng/14.4, 14.4-RELEASE-p2) + 2026-04-21 15:46:00 UTC (releng/14.3, 14.3-RELEASE-p11) + +For general information regarding FreeBSD Errata Notices and Security +Advisories, including descriptions of the fields above, security +branches, and the following sections, please visit +. + +I. Background + +The timerfd(2) family of system calls provides a file descriptor-based +interface for managing timers. + +II. Problem Description + +timerfd(2) implements periodic timers. The implementation had a bug which +caused it to fire too early in some cases. + +III. Impact + +The bug has been observed to cause excessive CPU usage in some applications, +particularly in some KDE desktop programs. + +IV. Workaround + +No workaround is available. + +V. Solution + +Upgrade your system to a supported FreeBSD stable or release / security +branch (releng) dated after the correction date, and reboot the system. + +Perform one of the following: + +1) To update your system installed from base system packages: + +Systems running a 15.0-RELEASE version of FreeBSD on the amd64 or arm64 +platforms, which were installed using base system packages, can be updated +via the pkg(8) utility: + +# pkg upgrade -r FreeBSD-base +# shutdown -r now + +2) To update your system installed from binary distribution sets: + +Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms, +or the i386 platform on FreeBSD 13, which were not installed using base +system packages, can be updated via the freebsd-update(8) utility: + +# freebsd-update fetch +# freebsd-update install +# shutdown -r now + +3) To update your system via a source code patch: + +The following patches have been verified to apply to the applicable +FreeBSD release branches. + +a) Download the relevant patch from the location below, and verify the +detached PGP signature using your PGP utility. + +# fetch https://security.FreeBSD.org/patches/EN-26:06/timerfd.patch +# fetch https://security.FreeBSD.org/patches/EN-26:06/timerfd.patch.asc +# gpg --verify timerfd.patch.asc + +b) Apply the patch. Execute the following commands as root: + +# cd /usr/src +# patch < /path/to/patch + +c) Recompile your kernel as described in + and reboot the +system. + +VI. Correction details + +This issue is corrected as of the corresponding Git commit hash in the +following stable and release branches: + +Branch/path Hash Revision +- ------------------------------------------------------------------------- +stable/15/ 9b785380f307 stable/15-n282826 +releng/15.0/ b0be1af0c48b releng/15.0-n281020 +stable/14/ 3c00f603a280 stable/14-n273878 +releng/14.4/ df8d2f945028 releng/14.4-n273684 +releng/14.3/ f37c6e3a133e releng/14.3-n271484 +- ------------------------------------------------------------------------- + +Run the following command to see which files were modified by a +particular commit: + +# git show --stat + +Or visit the following URL, replacing NNNNNN with the hash: + + + +To determine the commit count in a working tree (for comparison against +nNNNNNN in the table above), run: + +# git rev-list --count --first-parent HEAD + +VII. References + + + +The latest revision of this advisory is available at + +-----BEGIN PGP SIGNATURE----- + +iQIzBAEBCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmnnoZ8ACgkQbljekB8A +Gu9aeRAA28qaGYm351M3YdLLoo6XeT5iklKRCvPPZoIJtoP5V9UPUkW6NFkpYUqp +7sB3VrZ5xPImfCK1o6qE0oT9lnXqQZnGoPyqwoUJwcmRmLY/Js2s1zzn5q7qqdw0 +L/LseIFkvRelhy3KYSO9xnxm/eNQj/A0YK8w/Hi1tM0KR2IBtUjYVMKDvWLrPENH +z+mhlDBOCX1rbSz/E87WAZxZfarBG5XaGIytoBla8IEEsgaARVKr6iYqZaX17ZIZ +u0UgedQ38pQK0QQDhBE26gxwDu+2AZYo0SxdRXnVDkXUOgGkCoiGInyPLVQtrVcb +rmojbUDGDGbwraNkrUZ6wZjKJEArVJ9eC13AROSRc9vAneG3z2i52YaOGURrOZui +7yzj2d0SyglWhlV6sG/rJUAuTV7XB53JqzNyzLFm2tK3tlxOBMOEJp/qm0QG4sL/ +chXc/VIu8VqXeb3MmHtyWrMW+0hoLKI7pBVFdISiefjLRMHVscUZp3Ph7xvZT3GT ++hpvkMz2cp2CSn/N7+qHnEpoP8tgXPEneRPj3MgE0F6pqm3nVx/tAhoUBo9HYBRc +J6zWq5wkyRzIej6OFUM6gT3xRLeNLEODpDyKkcwanh9nvITVB7QbfmmC0E3fUfYM +NSGmlRNwnS9Nsuz0uF5Fj3gxEyhBMkBMfHRqV9rPimHgThrWcLM= +=omqs +-----END PGP SIGNATURE----- diff --git a/website/static/security/advisories/FreeBSD-EN-26:07.pkgbase.asc b/website/static/security/advisories/FreeBSD-EN-26:07.pkgbase.asc new file mode 100644 index 0000000000..f89f748f26 --- /dev/null +++ b/website/static/security/advisories/FreeBSD-EN-26:07.pkgbase.asc @@ -0,0 +1,113 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +============================================================================= +FreeBSD-EN-26:07.pkgbase Errata Notice + The FreeBSD Project + +Topic: Base packages fail to build with newer versions of libucl + +Category: core +Module: packages +Announced: 2026-04-21 +Affects: FreeBSD 15.0 +Corrected: 2026-04-07 11:27:02 UTC (stable/15, 15.0-STABLE) + 2026-04-21 15:44:26 UTC (releng/15.0, 15.0-RELEASE-p6) + +For general information regarding FreeBSD Errata Notices and Security +Advisories, including descriptions of the fields above, security +branches, and the following sections, please visit +. + +I. Background + +The libucl library is used for parsing documents in the UCL markup format. +The base system private Lua (flua) exposes libucl to Lua applications via +the "ucl" module. + +II. Problem Description + +In libucl version 0.9.3, an API change was made in the Lua ucl module +to prohibit the use of certain syntax by default, specifically the +".include" directive. This change causes the base system package build +("make update-packages") to fail when the host system is using libucl +0.9.3 or later. + +III. Impact + +Future versions of FreeBSD, which include libucl 0.9.3 or later, will +be unable to build FreeBSD 15.0 base system packages from source. + +IV. Workaround + +No workaround is available. + +V. Solution + +Update the base system source tree to a supported FreeBSD stable or +release / security branch (releng) dated after the correction date. + +No action is required on the host (build) system. + +To update your system via a source code patch: + +The following patches have been verified to apply to the applicable +FreeBSD release branches. + +a) Download the relevant patch from the location below, and verify the +detached PGP signature using your PGP utility. + +# fetch https://security.FreeBSD.org/patches/EN-26:07/pkgbase.patch +# fetch https://security.FreeBSD.org/patches/EN-26:07/pkgbase.patch.asc +# gpg --verify pkgbase.patch.asc + +b) Apply the patch. Execute the following commands as root: + +# cd /usr/src +# patch < /path/to/patch + +VI. Correction details + +This issue is corrected as of the corresponding Git commit hash in the +following stable and release branches: + +Branch/path Hash Revision +- ------------------------------------------------------------------------- +stable/15/ 976b2ebf4309 stable/15-n282865 +releng/15.0/ f3bbb238daa1 releng/15.0-n281021 +- ------------------------------------------------------------------------- + +Run the following command to see which files were modified by a +particular commit: + +# git show --stat + +Or visit the following URL, replacing NNNNNN with the hash: + + + +To determine the commit count in a working tree (for comparison against +nNNNNNN in the table above), run: + +# git rev-list --count --first-parent HEAD + +VII. References + +The latest revision of this advisory is available at + +-----BEGIN PGP SIGNATURE----- + +iQIzBAEBCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmnnoaEACgkQbljekB8A +Gu9oRhAAog+a+4hJ3OtOel1VVHOgB+JrKfKQHedMitP5RDZAy0e3tWBkm2lKXitv +akZIxFeqmJufBtZRQQSqa9Y9GSFklYHOXh+p/YvObshgkyXijHt+6DtcMtQEmryd +ZDSpVxBpmFP/taGHO7KdSOYuhoyaF5zYUzbuh62AlYHWD/48TPCyBWnEBzcPrGXz +Ew3FltDqKwtccACBZyI9VZFUMCTfCQeaOxB41zEhNGAbxu9DAmpD1t3e5kxHr8ji +imFRVwi0CsKvB9JGcU5BXKU1YtmG4hXEl9CvacNwxOFGjONB+MYZCNfdNXA9SDjn +9fRhz1TzVcFN6i4zWgu2YCV8id5YtaFQuYYjLZQczWgtoNKxBhqpEjeNGKTp1YIb +kwCdF+K+bbLPdtOl6w8E7q3Ksm7AluwbtjJaXskABgUYfXTSDlo6N/HHFd8WNRM0 ++u+XZ/DRhpgNVUDlQJU2XhfYKQyGyd3H//ZtD+ExQeMnTQYASBll3t6hhHx5wTWo +ZHpWJ1dUTZfv0vJMcNrIF0H81AgTigA6Saq4OrIYiec/4HBAIs+MeVO0oWCvF0bs +0g67n6+1Kxz29mXi2nWIbFmILZGEYq3J0y+hEJsr8gmRBgmWpFQJBOYUHXnZwYUG +q4YDpXvE9WWKATm/KB3clAd08QQej26P+Qow0ck1Gq17aPWCL6w= +=jKUS +-----END PGP SIGNATURE----- diff --git a/website/static/security/advisories/FreeBSD-SA-26:10.tty.asc b/website/static/security/advisories/FreeBSD-SA-26:10.tty.asc new file mode 100644 index 0000000000..42488b11cb --- /dev/null +++ b/website/static/security/advisories/FreeBSD-SA-26:10.tty.asc @@ -0,0 +1,165 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +============================================================================= +FreeBSD-SA-26:10.tty Security Advisory + The FreeBSD Project + +Topic: Kernel use-after-free bug in the TIOCNOTTY handler + +Category: core +Module: tty +Announced: 2026-04-21 +Credits: Nicholas Carlini using Claude, Anthropic +Affects: All supported versions of FreeBSD. +Corrected: 2026-04-21 15:43:02 UTC (stable/15, 15.0-STABLE) + 2026-04-21 15:44:27 UTC (releng/15.0, 15.0-RELEASE-p6) + 2026-04-21 15:43:13 UTC (stable/14, 14.4-STABLE) + 2026-04-21 15:45:31 UTC (releng/14.4, 14.4-RELEASE-p2) + 2026-04-21 15:46:01 UTC (releng/14.3, 14.3-RELEASE-p11) + 2026-04-21 15:43:56 UTC (stable/13, 13.5-STABLE) + 2026-04-21 15:47:07 UTC (releng/13.5, 13.5-RELEASE-p12) +CVE Name: CVE-2026-5398 + +For general information regarding FreeBSD Security Advisories, +including descriptions of the fields above, security branches, and the +following sections, please visit . + +I. Background + +TIOCNOTTY is an ioctl(2) operation which allows a process to detach itself +from its controlling terminal. Unprivileged processes may use this ioctl. +See the tty(4) manual page for more information on its usage. + +II. Problem Description + +The implementation of TIOCNOTTY failed to clear a back-pointer from the +structure representing the controlling terminal to the calling process' +session. If the invoking process then exits, the terminal structure +may end up containing a pointer to freed memory. + +III. Impact + +A malicious process can abuse the dangling pointer to grant itself root +privileges. + +IV. Workaround + +No workaround is available. + +V. Solution + +Upgrade your vulnerable system to a supported FreeBSD stable or +release / security branch (releng) dated after the correction date, +and reboot the system. + +Perform one of the following: + +1) To update your vulnerable system installed from base system packages: + +Systems running a 15.0-RELEASE version of FreeBSD on the amd64 or arm64 +platforms, which were installed using base system packages, can be updated +via the pkg(8) utility: + +# pkg upgrade -r FreeBSD-base +# shutdown -r +10min "Rebooting for a security update" + +2) To update your vulnerable system installed from binary distribution sets: + +Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms, +or the i386 platform on FreeBSD 13, which were not installed using base +system packages, can be updated via the freebsd-update(8) utility: + +# freebsd-update fetch +# freebsd-update install +# shutdown -r +10min "Rebooting for a security update" + +3) To update your vulnerable system via a source code patch: + +The following patches have been verified to apply to the applicable +FreeBSD release branches. + +a) Download the relevant patch from the location below, and verify the +detached PGP signature using your PGP utility. + +[FreeBSD 15.0] +# fetch https://security.FreeBSD.org/patches/SA-26:10/tty-15.patch +# fetch https://security.FreeBSD.org/patches/SA-26:10/tty-15.patch.asc +# gpg --verify tty-15.patch.asc + +[FreeBSD 14.4] +# fetch https://security.FreeBSD.org/patches/SA-26:10/tty-14.4.patch +# fetch https://security.FreeBSD.org/patches/SA-26:10/tty-14.4.patch.asc +# gpg --verify tty-14.4.patch.asc + +[FreeBSD 14.3] +# fetch https://security.FreeBSD.org/patches/SA-26:10/tty-14.3.patch +# fetch https://security.FreeBSD.org/patches/SA-26:10/tty-14.3.patch.asc +# gpg --verify tty-14.3.patch.asc + +[FreeBSD 13.5] +# fetch https://security.FreeBSD.org/patches/SA-26:10/tty-13.patch +# fetch https://security.FreeBSD.org/patches/SA-26:10/tty-13.patch.asc +# gpg --verify tty-13.patch.asc + +b) Apply the patch. Execute the following commands as root: + +# cd /usr/src +# patch < /path/to/patch + +c) Recompile your kernel as described in + and reboot the +system. + +VI. Correction details + +This issue is corrected as of the corresponding Git commit hash in the +following stable and release branches: + +Branch/path Hash Revision +- ------------------------------------------------------------------------- +stable/15/ 0c6b1e0864b8 stable/15-n283065 +releng/15.0/ fdee312d0c97 releng/15.0-n281022 +stable/14/ f46210a7ab32 stable/14-n273997 +releng/14.4/ af294329c57f releng/14.4-n273685 +releng/14.3/ 44077c07f19f releng/14.3-n271485 +stable/13/ 5eae7f23fe0e stable/13-n259845 +releng/13.5/ 2862a33bdd1c releng/13.5-n259210 +- ------------------------------------------------------------------------- + +Run the following command to see which files were modified by a +particular commit: + +# git show --stat + +Or visit the following URL, replacing NNNNNN with the hash: + + + +To determine the commit count in a working tree (for comparison against +nNNNNNN in the table above), run: + +# git rev-list --count --first-parent HEAD + +VII. References + + + +The latest revision of this advisory is available at + +-----BEGIN PGP SIGNATURE----- + +iQIzBAEBCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmnnoaMACgkQbljekB8A +Gu8qzA//fuGHRB8Y+n+EUyAGycr0PGMeG423hykkYBAvfBJJP5RYv4Ter79YAeuu +zqXqijjr+yyKcE1+km63/koxUXZmkbpR2Xt/0i2d3jAqnrUioZqwc+llCgqhh6Dr +AhyDn+xCtCWJow0Iktlk6ZHEuQLX6kwGxT/1cvmcnhZE8XQf2PNEbRk8oit+kf8c +LQZF2EBK4wPh5Lik8DvqoyX1k7B44jVhL2AMqs/2fRdTFluY/MIgvbRsRdCQRLJE +doXA2YdDljkTJpAPIg31WP6C7L0LPkeyRm4Xn3zBt4SalyiChfQ9kQYcdQS7/lt4 +LUyrQKQHVtVx2SseYFTtPoncYl2IEmaHOAZkQrfzxFybYryoq4macGbuNZh0Aygq +mpIAIIDKAyKQCcDGzluRL4ksoPyw9Kav7SJJ83P9khrKINaNg5NZc1Ptc7K/UvSk +H5XKwHBaURcXGzl1crBtqbbK5lEvO/UaxXraMwqCTM+WqF7dND2KvSbZEma/FJ8l +7Wcszs2dvgC2dQghlmRlxxYvMGzf49XO4+Y64WarMqmLTAyDV9nBrZGMUj1M2nqC +rgylEscbOn8z/Yq8vpr0sydYRVDBHtVMOaztsqFylGnzRfSjQQH3yuJ40ngvy9yo +GexBhYXFyrruuuuz9p9xplIRzVkHVjkrm9/zwe4bSBylQ+/MeGQ= +=crMa +-----END PGP SIGNATURE----- diff --git a/website/static/security/advisories/FreeBSD-SA-26:11.amd64.asc b/website/static/security/advisories/FreeBSD-SA-26:11.amd64.asc new file mode 100644 index 0000000000..99e84cbf24 --- /dev/null +++ b/website/static/security/advisories/FreeBSD-SA-26:11.amd64.asc @@ -0,0 +1,163 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +============================================================================= +FreeBSD-SA-26:11.amd64 Security Advisory + The FreeBSD Project + +Topic: Missing large page handling in pmap_pkru_update_range() + +Category: core +Module: amd64 +Announced: 2026-04-21 +Credits: Nicholas Carlini using Claude, Anthropic +Affects: All supported versions of FreeBSD. +Corrected: 2026-04-21 15:43:03 UTC (stable/15, 15.0-STABLE) + 2026-04-21 15:44:28 UTC (releng/15.0, 15.0-RELEASE-p6) + 2026-04-21 15:43:14 UTC (stable/14, 14.4-STABLE) + 2026-04-21 15:45:32 UTC (releng/14.4, 14.4-RELEASE-p2) + 2026-04-21 15:46:03 UTC (releng/14.3, 14.3-RELEASE-p11) + 2026-04-21 15:43:57 UTC (stable/13, 13.5-STABLE) + 2026-04-21 15:47:08 UTC (releng/13.5, 13.5-RELEASE-p12) +CVE Name: CVE-2026-6386 + +For general information regarding FreeBSD Security Advisories, +including descriptions of the fields above, security branches, and the +following sections, please visit . + +I. Background + +Memory protection keys are an amd64 CPU feature, available in modern Intel and +AMD CPUs, which allow applications to apply access restrictions to regions of +virtual memory. On FreeBSD this functionality is provided by the pkru(3) +interface. + +II. Problem Description + +In order to apply a particular protection key to an address range, the kernel +must update the corresponding page table entries. The subroutine which handled +this failed to take into account the presence of 1GB largepage mappings created +using the shm_create_largepage(3) interface. In particular, it would always +treat a page directory page entry as pointing to another page table page. + +III. Impact + +The bug can be abused by an unprivileged user to cause pmap_pkru_update_range() +to treat userspace memory as a page table page, and thus overwrite memory to +which the application would otherwise not have access. + +IV. Workaround + +No workaround is available. The bug only affects amd64 systems. + +V. Solution + +Upgrade your vulnerable system to a supported FreeBSD stable or +release / security branch (releng) dated after the correction date, +and reboot the system. + +Perform one of the following: + +1) To update your vulnerable system installed from base system packages: + +Systems running a 15.0-RELEASE version of FreeBSD on the amd64 or arm64 +platforms, which were installed using base system packages, can be updated +via the pkg(8) utility: + +# pkg upgrade -r FreeBSD-base +# shutdown -r +10min "Rebooting for a security update" + +2) To update your vulnerable system installed from binary distribution sets: + +Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms, +or the i386 platform on FreeBSD 13, which were not installed using base +system packages, can be updated via the freebsd-update(8) utility: + +# freebsd-update fetch +# freebsd-update install +# shutdown -r +10min "Rebooting for a security update" + +3) To update your vulnerable system via a source code patch: + +The following patches have been verified to apply to the applicable +FreeBSD release branches. + +a) Download the relevant patch from the location below, and verify the +detached PGP signature using your PGP utility. + +[FreeBSD 15.0] +# fetch https://security.FreeBSD.org/patches/SA-26:11/amd64-15.patch +# fetch https://security.FreeBSD.org/patches/SA-26:11/amd64-15.patch.asc +# gpg --verify amd64-15.patch.asc + +[FreeBSD 14.4 and 14.3] +# fetch https://security.FreeBSD.org/patches/SA-26:11/amd64-14.patch +# fetch https://security.FreeBSD.org/patches/SA-26:11/amd64-14.patch.asc +# gpg --verify amd64-14.patch.asc + +[FreeBSD 13.5] +# fetch https://security.FreeBSD.org/patches/SA-26:11/amd64-13.patch +# fetch https://security.FreeBSD.org/patches/SA-26:11/amd64-13.patch.asc +# gpg --verify amd64-13.patch.asc + +b) Apply the patch. Execute the following commands as root: + +# cd /usr/src +# patch < /path/to/patch + +c) Recompile your kernel as described in + and reboot the +system. + +VI. Correction details + +This issue is corrected as of the corresponding Git commit hash in the +following stable and release branches: + +Branch/path Hash Revision +- ------------------------------------------------------------------------- +stable/15/ 9331e62e8b80 stable/15-n283066 +releng/15.0/ 649db49403a7 releng/15.0-n281023 +stable/14/ 4c0e5e3cc441 stable/14-n273998 +releng/14.4/ 5787df30dc3e releng/14.4-n273686 +releng/14.3/ 979e645dd25e releng/14.3-n271486 +stable/13/ b8fc56193068 stable/13-n259846 +releng/13.5/ a2f6f2d00125 releng/13.5-n259211 +- ------------------------------------------------------------------------- + +Run the following command to see which files were modified by a +particular commit: + +# git show --stat + +Or visit the following URL, replacing NNNNNN with the hash: + + + +To determine the commit count in a working tree (for comparison against +nNNNNNN in the table above), run: + +# git rev-list --count --first-parent HEAD + +VII. References + + + +The latest revision of this advisory is available at + +-----BEGIN PGP SIGNATURE----- + +iQIzBAEBCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmnnoakACgkQbljekB8A +Gu8xHBAA0UShf6OLTcPprJ4YbzORKrmUeN6MPSwrvtn792T01Fi7zXj1IeBd1/N1 +25SI2GBhoMWP1wBR9G0Er8Vjv9cn4lnuWCeBIMmaofgLUi/UahT5lLhQGG7e3ypq +DdmfyWwnJ7tAkDvxHUH2t3STjzIsQaH2NSTpxcg5bdSbGSPGr7On2RBKalvLLBon +SUx8FtlOpDj+TttxidoQcYeez8vCkdgn9PCbA/9cxZlFmy+ioE/14PQU2TAYbcnK +mZ3BWOKxRDlBN9zHBwkaSdIgjs6+t0/pCYrlUu2nCaZ9o6dtn/6WtulcuCB/l9DQ +UABsdc2uhCZvafdN316lABxaPLm3+uvcOFqRZs24tkLOYk5JxBYQQdaHrZ4cP+xS +IgQf/Zl5s/ZlwfzOjzTg54KLyH7yxR5iJ/JIJ2mRJ5PZ9wavYGM6czf4l9w+sYQw +wTTQSO/zdLRHgcKUYdq+xpv2AWEkjkZSRxRQhgMZ9rS5V+1MqhnCLs9uCsG/Ns7c +Yv7t8I+r7j3gjdEFJRDVW+awHQR2ppI/odmyABaThG3bBdPxXy9pR0IvSYtZKGEW +cUjYp2intHCDna0TSa4nzrTlCZCAZijVKeVLXSrYNvrJ9nE3dB8oESP2YASjyJBM +VxpRYXmjprazBYcRgt7kf/tSfpky7Cq59H1NU+pVxaR5TAzWvaI= +=kWUu +-----END PGP SIGNATURE----- diff --git a/website/static/security/patches/EN-26:05/vm-13.patch b/website/static/security/patches/EN-26:05/vm-13.patch new file mode 100644 index 0000000000..17aea3c29f --- /dev/null +++ b/website/static/security/patches/EN-26:05/vm-13.patch @@ -0,0 +1,37 @@ +--- sys/vm/vm_fault.c.orig ++++ sys/vm/vm_fault.c +@@ -242,8 +242,6 @@ + static void + fault_deallocate(struct faultstate *fs) + { +- +- fs->m_needs_zeroing = true; + fault_page_release(&fs->m_cow); + fault_page_release(&fs->m); + vm_object_pip_wakeup(fs->object); +@@ -1202,7 +1200,8 @@ + vm_waitpfault(dset, vm_pfault_oom_wait * hz); + return (FAULT_RESTART); + } +- fs->m_needs_zeroing = (fs->m->flags & PG_ZERO) == 0; ++ if (fs->object == fs->first_object) ++ fs->m_needs_zeroing = (fs->m->flags & PG_ZERO) == 0; + fs->oom_started = false; + + return (FAULT_CONTINUE); +@@ -1462,7 +1461,6 @@ + fs.fault_flags = fault_flags; + fs.map = map; + fs.lookup_still_valid = false; +- fs.m_needs_zeroing = true; + fs.oom_started = false; + fs.nera = -1; + faultcount = 0; +@@ -1470,6 +1468,7 @@ + + RetryFault: + fs.fault_type = fault_type; ++ fs.m_needs_zeroing = true; + + /* + * Find the backing store object and offset into it to begin the diff --git a/website/static/security/patches/EN-26:05/vm-13.patch.asc b/website/static/security/patches/EN-26:05/vm-13.patch.asc new file mode 100644 index 0000000000..03a52af1a4 --- /dev/null +++ b/website/static/security/patches/EN-26:05/vm-13.patch.asc @@ -0,0 +1,16 @@ +-----BEGIN PGP SIGNATURE----- + +iQIzBAABCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmnnoZsACgkQbljekB8A +Gu8G9xAAr5GsurThSC4pSyxC7DbYuXK9YZzMlPH8vRR03O3fF/j59FYQrbzh+ZmC +YsBjOh6p1ljOZrO3VWohjr7VzLtALgifKT2HL8Rn3Etmlpf5TUnEkjksFTSRhVZZ +jOKow4pyR95n/7eC3R51sz5euxSvlqMfLYlmx32f1gZ6TEAOaTUjtCneQ1QCvLNq +6lrtvMIs1BUkG6/aAVGe+GvkpBLuuoT5nhXRHHbHICR5mtgmf26YxbttLHvSATJn +NYISF8yiesjVXy4uU7lFBmRQ7ZZmBtltsULjQ3uNiksw04+RTNRS/QNVzI7G4ha6 +gHfSKE3F4lb5vuxKGXKXwXkwXF90fO5436HgWlePjZGn+GFPA/mCwKrJVa4MawfZ +LE/iEhu60wncTT/ivjdEeg8bcvQlG951yif6z2aqwoIz0BD650ufllxpIINCZdsW +Iz8Yw8z2uzkyvPamvSQlAN7JENStza/pbdfnu3GZgwrjLJtf+RJon4F/v1JzBtSG +P/8s1PReEyaiIDOifB0NSpopTW6satPC1dThg1LW2Y+lfyy6U3rCgKXHCzPGjQsI +ZV/90eUDX+uwfM9TvRo8znt/zFqh2Q90pr/qbJUdpZsTsNxC/ZEN0AzVkrrwp46/ +v/q1wJfmNaQfYSQLc8y+FmhwvesvDLy/dxy8eq0w8CqUqqBa19s= +=csNp +-----END PGP SIGNATURE----- diff --git a/website/static/security/patches/EN-26:05/vm-14.patch b/website/static/security/patches/EN-26:05/vm-14.patch new file mode 100644 index 0000000000..2e6979c244 --- /dev/null +++ b/website/static/security/patches/EN-26:05/vm-14.patch @@ -0,0 +1,37 @@ +--- sys/vm/vm_fault.c.orig ++++ sys/vm/vm_fault.c +@@ -272,8 +272,6 @@ + static void + vm_fault_deallocate(struct faultstate *fs) + { +- +- fs->m_needs_zeroing = true; + vm_fault_page_release(&fs->m_cow); + vm_fault_page_release(&fs->m); + vm_object_pip_wakeup(fs->object); +@@ -1321,7 +1319,8 @@ + vm_waitpfault(dset, vm_pfault_oom_wait * hz); + return (FAULT_RESTART); + } +- fs->m_needs_zeroing = (fs->m->flags & PG_ZERO) == 0; ++ if (fs->object == fs->first_object) ++ fs->m_needs_zeroing = (fs->m->flags & PG_ZERO) == 0; + fs->oom_started = false; + + return (FAULT_CONTINUE); +@@ -1653,7 +1652,6 @@ + fs.fault_flags = fault_flags; + fs.map = map; + fs.lookup_still_valid = false; +- fs.m_needs_zeroing = true; + fs.oom_started = false; + fs.nera = -1; + fs.can_read_lock = true; +@@ -1662,6 +1660,7 @@ + + RetryFault: + fs.fault_type = fault_type; ++ fs.m_needs_zeroing = true; + + /* + * Find the backing store object and offset into it to begin the diff --git a/website/static/security/patches/EN-26:05/vm-14.patch.asc b/website/static/security/patches/EN-26:05/vm-14.patch.asc new file mode 100644 index 0000000000..940e150b3d --- /dev/null +++ b/website/static/security/patches/EN-26:05/vm-14.patch.asc @@ -0,0 +1,16 @@ +-----BEGIN PGP SIGNATURE----- + +iQIzBAABCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmnnoZwACgkQbljekB8A +Gu9FrxAAxQaGukd6JDEY/DliFPK97voostmMZD8S1Yn4FamsDVC+3qrkggPSu4TP +x10jLXIYIO2LpkVDabAJNA3tHgKzuy1Z3ORjudYTcodNIaab1JUWfgAw0Lw7V4g5 +Xl6OWHBml8fpzekxE35/x4MLXeokRZz8aNZUWFZbmQ5gA+gg1QpzNMmpytk6l6FM +Sp2nUEMUOsa+VXJBSIktgVWErtQ8n0NjwlKo69qHZwLyWtuprf5iMI2LZ5DYUQns +wjr/gvZe8Du8/cwgzeDuPRuTkDAxvfh7JyDhpgm26Tp4weXMuBOqBK9jycp6jh/y +GxoFcp/DL5EjqK06N4Ht8ZheNKJOdSLkTnQe3khgVXM01TN+VtwpsN4GfLmpsrt+ +7NesWyiW3HgTMSL6ulUT5HaE2q/8IG+FKYLQDCoBRiu7gqQkEBsX/72V0byxlZ0W +K+c/ASELy53ZF7UqBkdA/+4qWFxO9qTKiZrwmNM8g0Ss1bA72WEmk+a766YV4ioM +fWpyP9+Py2Rth5B8DyzgIX7JkstFxZNhg+oN0aQ6khIzeoLiahjO+7CKaYWIqMVh +TXKRJJyAwXj6cllekELQmwG97JeKbK22jgqEvzDxA4HWASjXjpwbNtrrOJNPtpeh +QbpzHOLM++6/LmtUsQaLD+4DJyYYBeFI1daSxe6X19gHubbhgIU= +=19Gd +-----END PGP SIGNATURE----- diff --git a/website/static/security/patches/EN-26:05/vm-15.patch b/website/static/security/patches/EN-26:05/vm-15.patch new file mode 100644 index 0000000000..e18deab8df --- /dev/null +++ b/website/static/security/patches/EN-26:05/vm-15.patch @@ -0,0 +1,37 @@ +--- sys/vm/vm_fault.c.orig ++++ sys/vm/vm_fault.c +@@ -273,8 +273,6 @@ + static void + vm_fault_deallocate(struct faultstate *fs) + { +- +- fs->m_needs_zeroing = true; + vm_fault_page_release(&fs->m_cow); + vm_fault_page_release(&fs->m); + vm_object_pip_wakeup(fs->object); +@@ -1370,7 +1368,8 @@ + vm_waitpfault(dset, vm_pfault_oom_wait * hz); + return (FAULT_RESTART); + } +- fs->m_needs_zeroing = (fs->m->flags & PG_ZERO) == 0; ++ if (fs->object == fs->first_object) ++ fs->m_needs_zeroing = (fs->m->flags & PG_ZERO) == 0; + fs->oom_started = false; + + return (FAULT_CONTINUE); +@@ -1705,7 +1704,6 @@ + fs.fault_flags = fault_flags; + fs.map = map; + fs.lookup_still_valid = false; +- fs.m_needs_zeroing = true; + fs.oom_started = false; + fs.nera = -1; + fs.can_read_lock = true; +@@ -1714,6 +1712,7 @@ + + RetryFault: + fs.fault_type = fault_type; ++ fs.m_needs_zeroing = true; + + /* + * Find the backing store object and offset into it to begin the diff --git a/website/static/security/patches/EN-26:05/vm-15.patch.asc b/website/static/security/patches/EN-26:05/vm-15.patch.asc new file mode 100644 index 0000000000..66943c60ee --- /dev/null +++ b/website/static/security/patches/EN-26:05/vm-15.patch.asc @@ -0,0 +1,16 @@ +-----BEGIN PGP SIGNATURE----- + +iQIzBAABCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmnnoZ4ACgkQbljekB8A +Gu8G6w//TlGub/hDpizdLo4o9UuAjBVG+FNaTl8UErIBIfy/rVIf9KmOIEqA3Boo +CHct4nE0WcWhnkFZsPDsVmyehrpstmeYWNLlJP1gBioaKAd001EJzKxTpoMFq5cC +PuDUtkPN65W13TP7+1lYnv2VSYraJ0NVG0eCfTGm0dISCVUDO35WQTFvXstcbkqm +B8GnJQvG6KzA3ju+IlR1NUf28PfqclIUkty5nGf2P1waN6BLqe4sN3vG2yAgUUnN +38czltWOEwsUcZSWcKv/TsaeIcBKTvcf2EdQ//BmBZNEAhCIXbX7+p1vtD8F2IBx +mBnTsfs/RkLjgundg7L5sD4F61PLAJfS9IkI/ZCi5biouCqr2FQGznV7sUGPNmOf +SxjJ8REj7gdPlv59Kj/J3ydCVig7l6etumpM15bwtZeAW//19bw7ixYmSQa2iXu+ +kEiMl7i9u+/Vcc3KVCwDjov7vsUW4nqTogzhP7XqmMGu0vOigWogH963E3vHh2Gv +4vxVuna1DYkai+x/7F0UfTUVFQpeawDTNURWNKzzaw8rL1OllYUevDfygvpE01Vt +rmQsZUpf5nJus4HmXEIdBRwledtvyOF//+M4ZB1Ggv3ney7+WgGaV1cr1tT6mX6j +dvXJHwQEEzl4qe99AfyaRFGaMp1vb9nBE2smJOsytneqV55wC7M= +=R9hc +-----END PGP SIGNATURE----- diff --git a/website/static/security/patches/EN-26:06/timerfd.patch b/website/static/security/patches/EN-26:06/timerfd.patch new file mode 100644 index 0000000000..75cbad7be3 --- /dev/null +++ b/website/static/security/patches/EN-26:06/timerfd.patch @@ -0,0 +1,39 @@ +--- sys/kern/sys_timerfd.c.orig ++++ sys/kern/sys_timerfd.c +@@ -393,23 +393,25 @@ + timerfd_expire(void *arg) + { + struct timerfd *tfd = (struct timerfd *)arg; +- struct timespec uptime; ++ sbintime_t exp, interval, now, next, diff; + + ++tfd->tfd_count; + tfd->tfd_expired = true; + if (timespecisset(&tfd->tfd_time.it_interval)) { ++ exp = tstosbt(tfd->tfd_time.it_value); ++ interval = tstosbt(tfd->tfd_time.it_interval); ++ now = sbinuptime(); ++ next = now + interval; ++ + /* Count missed events. */ +- nanouptime(&uptime); +- if (timespeccmp(&uptime, &tfd->tfd_time.it_value, >)) { +- timespecsub(&uptime, &tfd->tfd_time.it_value, &uptime); +- tfd->tfd_count += tstosbt(uptime) / +- tstosbt(tfd->tfd_time.it_interval); ++ if (now > exp) { ++ diff = now - exp; ++ tfd->tfd_count += diff / interval; ++ next -= diff % interval; + } +- timespecadd(&tfd->tfd_time.it_value, +- &tfd->tfd_time.it_interval, &tfd->tfd_time.it_value); +- callout_schedule_sbt(&tfd->tfd_callout, +- tstosbt(tfd->tfd_time.it_value), +- 0, C_ABSOLUTE); ++ ++ callout_schedule_sbt(&tfd->tfd_callout, next, 0, C_ABSOLUTE); ++ tfd->tfd_time.it_value = sbttots(next); + } else { + /* Single shot timer. */ + callout_deactivate(&tfd->tfd_callout); diff --git a/website/static/security/patches/EN-26:06/timerfd.patch.asc b/website/static/security/patches/EN-26:06/timerfd.patch.asc new file mode 100644 index 0000000000..dd6ba3a15a --- /dev/null +++ b/website/static/security/patches/EN-26:06/timerfd.patch.asc @@ -0,0 +1,16 @@ +-----BEGIN PGP SIGNATURE----- + +iQIzBAABCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmnnoaAACgkQbljekB8A +Gu9mfhAAtH/CEXo4l2ZgJJwWP58rIkiySYrNcFny8Kh6OjTfKy8hBl6UuSPto/9G +tvsmpCmiOtkPbNxvPibXuP4CEoXksTkfTyvmb2opDIK/ZUjGpFS+eBXRnoUgjdaU +LZMdHU33LD3RX+qirJiOgit2bajsAHLknjiqR+gpTZuW2TwWGzHOsITPt/eJ4Fbd +cjYW1nfoXKj7kIErY9SWBYDlKBVA+sD5nQ8c4b7VVuWoTR2iLREVef/QJQCrCeQe +JMSW4nKVZOEThLQarhA3fF4XKw7DXB/uFxyXtknZapCW/kDOc/gAKEwouoaVARff +ACD8drBEqUqiNmS/QWeRbFEtiauw03S+sHiR5uzsognQFpttZNSpfGxckr9viI+9 +uU7N7cyXep7snwcFr+7P3nHiJ9+1phNT0ho3y4cpVSGk1QPhNJlLKtDLYYpOU/lD +uEroV8tgs97CKnOG2JqwrgSiFQwbpJu8uhsPEQA04AwJbtkd8efCfGyt9xtiEB8Z +tnj4iFqEbacyZzN+qGH+7RlFFtd7rmfpfQXwY7RWjrWc984EVWm2CleOpURZpeT/ +7odnjn8Rr5vJVgWad5uH90dW8kZOxC+MWZJyPxD5/5JyQpdBHI7Gfzs0Yo8q1VqP +rUHde/b6lEuPd5TrkQ4xtgwN6Em0LMw7r7cy88Q8WR1YI59YIWU= +=Mu/l +-----END PGP SIGNATURE----- diff --git a/website/static/security/patches/EN-26:07/pkgbase.patch b/website/static/security/patches/EN-26:07/pkgbase.patch new file mode 100644 index 0000000000..83ef38f19f --- /dev/null +++ b/website/static/security/patches/EN-26:07/pkgbase.patch @@ -0,0 +1,22 @@ +--- release/packages/generate-set-ucl.lua.orig ++++ release/packages/generate-set-ucl.lua +@@ -16,7 +16,7 @@ + local ucl = require("ucl") + + -- This parser is the output UCL we want to build. +-local parser = ucl.parser() ++local parser = ucl.parser(0) + + if #arg < 1 then + io.stderr:write(arg[0] .. ": missing template filename\n") +--- release/packages/generate-ucl.lua.orig ++++ release/packages/generate-ucl.lua +@@ -124,7 +124,7 @@ + local pkgversion = nil + + -- This parser is the output UCL we want to build. +-local parser = ucl.parser() ++local parser = ucl.parser(0) + + -- Set any $VARIABLES from the command line in the parser. This causes ucl to + -- automatically replace them when we load the source ucl. diff --git a/website/static/security/patches/EN-26:07/pkgbase.patch.asc b/website/static/security/patches/EN-26:07/pkgbase.patch.asc new file mode 100644 index 0000000000..e5d5ae54ab --- /dev/null +++ b/website/static/security/patches/EN-26:07/pkgbase.patch.asc @@ -0,0 +1,16 @@ +-----BEGIN PGP SIGNATURE----- + +iQIzBAABCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmnnoaIACgkQbljekB8A +Gu96SxAAjYt9UeZq5utoATKbYq9fEz+mi+wIiZG3Fa7RwLX7mL5HsslHGedgWN/B +Xy5IvCSs48Yg+xQctFbdmy20iW4kgxA9/EbZHx6jtUcMp8ieEpO+yAuISjkGyUp8 +XE7bmJun3StWZKuh4gKaGs+6dJJRgdQKQ36Gvd/jY+0rhixMSW4OK/bXetoe6/5g +ClgeawtzL6Iz0SCMnKtKuUHjePh8YoX2NHt8skWTIGy7tILSVq8Vd2LI2KjzzZBg +CYulcms96DfICYmXVJFNcP2qcVRtXfqMHAEekSgijQ8Mxj6+E1xwSmsuSKPzby7b +eyeXiI4o2w8p1oSWaxE6c5yD4WfeEgjrux1kQU9o+JFkMMjSfKLshijkVp6JqJWq +BK6f/Mngo2e3okOF1eNSxAp0BFfnIpyI2AVCBqqqqj8QF6QaRxRS7vtwxBp+JTc6 +nFsMLyIzuAb2vJCpRTJvmqf4UK93lS3tETS94OQilhGncuMQSE/Rp7jO8diquqrC +d6jsKtN6GKx8mNaLcVb7xmyFTYZ0DleD/dsFQ3hB2zfe1BskBvgmmBHZ5ojtXKoi +N99vABc5B1WAqda6rTnJUt3g7CbF9ATIAZ44sd14hLJEYz5c7GIQDFDSFZpnR+2Y +kD7EySAxXhW9J8Wl6n6ggxEFuikASF761K2ueu7KBWz9a3Ei7gg= +=ma0B +-----END PGP SIGNATURE----- diff --git a/website/static/security/patches/SA-26:10/tty-13.patch b/website/static/security/patches/SA-26:10/tty-13.patch new file mode 100644 index 0000000000..cbc62f2962 --- /dev/null +++ b/website/static/security/patches/SA-26:10/tty-13.patch @@ -0,0 +1,108 @@ +--- sys/kern/tty.c.orig ++++ sys/kern/tty.c +@@ -1262,6 +1262,10 @@ + session->s_ttydp = NULL; + SESS_UNLOCK(session); + ++ if (tp->t_session == session) { ++ tp->t_session = NULL; ++ tp->t_pgrp = NULL; ++ } + tp->t_sessioncnt--; + p->p_flag &= ~P_CONTROLT; + PROC_UNLOCK(p); +--- tests/sys/kern/Makefile.orig ++++ tests/sys/kern/Makefile +@@ -35,6 +35,7 @@ + PLAIN_TESTS_C+= subr_unit_test + ATF_TESTS_C+= sysctl_kern_proc + ATF_TESTS_C+= sys_getrandom ++PLAIN_TESTS_C+= tiocnotty + ATF_TESTS_C+= tty_pts + ATF_TESTS_C+= unix_passfd_test + ATF_TESTS_C+= unix_seqpacket_test +--- /dev/null ++++ tests/sys/kern/tiocnotty.c +@@ -0,0 +1,82 @@ ++/* ++ * Copyright (c) 2026 Mark Johnston ++ * ++ * SPDX-License-Identifier: BSD-2-Clause ++ */ ++ ++/* ++ * A regression test that exercises a bug where TIOCNOTTY would leave some ++ * dangling pointers behind in the controlling terminal structure. ++ */ ++ ++#include ++#include ++ ++#include ++#include ++#include ++#include ++#include ++ ++int ++main(void) ++{ ++ int master, slave, status; ++ pid_t child; ++ ++ master = posix_openpt(O_RDWR | O_NOCTTY); ++ if (master < 0) ++ err(1, "posix_openpt"); ++ if (grantpt(master) < 0) ++ err(1, "grantpt"); ++ if (unlockpt(master) < 0) ++ err(1, "unlockpt"); ++ ++ child = fork(); ++ if (child < 0) ++ err(1, "fork"); ++ if (child == 0) { ++ if (setsid() < 0) ++ err(1, "setsid"); ++ slave = open(ptsname(master), O_RDWR | O_NOCTTY); ++ if (slave < 0) ++ err(2, "open"); ++ if (ioctl(slave, TIOCSCTTY, 0) < 0) ++ err(3, "ioctl(TIOCSCTTY)"); ++ /* Detach ourselves from the controlling terminal. */ ++ if (ioctl(slave, TIOCNOTTY, 0) < 0) ++ err(4, "ioctl(TIOCNOTTY)"); ++ _exit(0); ++ } ++ ++ if (waitpid(child, &status, 0) < 0) ++ err(1, "waitpid"); ++ if (!WIFEXITED(status) || WEXITSTATUS(status) != 0) ++ errx(1, "child exited with status %d", WEXITSTATUS(status)); ++ ++ child = fork(); ++ if (child < 0) ++ err(1, "fork"); ++ if (child == 0) { ++ struct winsize winsz; ++ ++ if (setsid() < 0) ++ err(1, "setsid"); ++ slave = open(ptsname(master), O_RDWR | O_NOCTTY); ++ if (slave < 0) ++ err(2, "open"); ++ /* Dereferences dangling t_pgrp pointer in the terminal. */ ++ memset(&winsz, 0xff, sizeof(winsz)); ++ if (ioctl(slave, TIOCSWINSZ, &winsz) < 0) ++ err(3, "ioctl(TIOCSWINSZ)"); ++ /* Dereferences dangling t_session pointer in the terminal. */ ++ if (ioctl(slave, TIOCSCTTY, 0) < 0) ++ err(4, "ioctl(TIOCSCTTY)"); ++ _exit(0); ++ } ++ ++ if (waitpid(child, &status, 0) < 0) ++ err(1, "waitpid"); ++ if (!WIFEXITED(status) || WEXITSTATUS(status) != 0) ++ errx(1, "child exited with status %d", WEXITSTATUS(status)); ++} diff --git a/website/static/security/patches/SA-26:10/tty-13.patch.asc b/website/static/security/patches/SA-26:10/tty-13.patch.asc new file mode 100644 index 0000000000..fcbdf0dc3b --- /dev/null +++ b/website/static/security/patches/SA-26:10/tty-13.patch.asc @@ -0,0 +1,16 @@ +-----BEGIN PGP SIGNATURE----- + +iQIzBAABCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmnnoaUACgkQbljekB8A +Gu8CGBAArN7j/5++Cn80jErvso5xKBsMuNlWVdKOrxedO8upL+ma03tKqeb3z4Be +kjkO1LuOFFNH3HBjAd5VG9d+hOaXqt1Lcf3AtnJvWru/Xai1m4eEJZYtAaeGlsDq +uozDyMr4D71bzdmNT+yezPiDEo+w8p9niXKf3f1ZWWpEklTgeeKWVFNb4QwSboQg +IYgi9/iH7sSjrzIZoFnC5ZhSdLwMB6RLds8K0XrbLC9DoDmQWw6vJBYEa1Nd9a/X +gv0jgjWetHm6jkDUDq2mtTmWuKlF9+a82KvLxNreen04FduZazxezzfeuriAJAKX +CHE3EREa99uSnarna0xklRIRqzOWLs+ys/7AEBXbzMbRiVtBD8r+Wfy/wiy1sDUZ +TCFea3XwZiI65ys0OL0yiLVqrN5PeDgHjMEqMIQXOejtGoKtsOchjcfpwSVVh26v +YmVEGTJUwJIi9+eN0BQF6nvynl75kK3SH4PUjatm1kX6OjobPMpxtHM9jsZm6qoY +fj8FTh2DcGXglJAzf60YFk6Awx1iYW1RAaIURFvbA9ZzG+K0dN93b1OcWNHgnyAw +WTwl8RTGU0ztvdCwqyyc0yl3g2tDKi4eufJ6QmanP1BjwGig/SufkBE1Qr2hTyLp +rOwNjXPKkSg23W/W4zRn1kyUGLM1ahh/wyPfppy6hxRQb442cWM= +=Fhm4 +-----END PGP SIGNATURE----- diff --git a/website/static/security/patches/SA-26:10/tty-14.3.patch b/website/static/security/patches/SA-26:10/tty-14.3.patch new file mode 100644 index 0000000000..49764c0e05 --- /dev/null +++ b/website/static/security/patches/SA-26:10/tty-14.3.patch @@ -0,0 +1,108 @@ +--- sys/kern/tty.c.orig ++++ sys/kern/tty.c +@@ -1262,6 +1262,10 @@ + session->s_ttydp = NULL; + SESS_UNLOCK(session); + ++ if (tp->t_session == session) { ++ tp->t_session = NULL; ++ tp->t_pgrp = NULL; ++ } + tp->t_sessioncnt--; + p->p_flag &= ~P_CONTROLT; + PROC_UNLOCK(p); +--- tests/sys/kern/Makefile.orig ++++ tests/sys/kern/Makefile +@@ -41,6 +41,7 @@ + PLAIN_TESTS_C+= subr_unit_test + ATF_TESTS_C+= sysctl_kern_proc + ATF_TESTS_C+= sys_getrandom ++PLAIN_TESTS_C+= tiocnotty + ATF_TESTS_C+= tty_pts + ATF_TESTS_C+= unix_dgram + ATF_TESTS_C+= unix_passfd_dgram +--- /dev/null ++++ tests/sys/kern/tiocnotty.c +@@ -0,0 +1,82 @@ ++/* ++ * Copyright (c) 2026 Mark Johnston ++ * ++ * SPDX-License-Identifier: BSD-2-Clause ++ */ ++ ++/* ++ * A regression test that exercises a bug where TIOCNOTTY would leave some ++ * dangling pointers behind in the controlling terminal structure. ++ */ ++ ++#include ++#include ++ ++#include ++#include ++#include ++#include ++#include ++ ++int ++main(void) ++{ ++ int master, slave, status; ++ pid_t child; ++ ++ master = posix_openpt(O_RDWR | O_NOCTTY); ++ if (master < 0) ++ err(1, "posix_openpt"); ++ if (grantpt(master) < 0) ++ err(1, "grantpt"); ++ if (unlockpt(master) < 0) ++ err(1, "unlockpt"); ++ ++ child = fork(); ++ if (child < 0) ++ err(1, "fork"); ++ if (child == 0) { ++ if (setsid() < 0) ++ err(1, "setsid"); ++ slave = open(ptsname(master), O_RDWR | O_NOCTTY); ++ if (slave < 0) ++ err(2, "open"); ++ if (ioctl(slave, TIOCSCTTY, 0) < 0) ++ err(3, "ioctl(TIOCSCTTY)"); ++ /* Detach ourselves from the controlling terminal. */ ++ if (ioctl(slave, TIOCNOTTY, 0) < 0) ++ err(4, "ioctl(TIOCNOTTY)"); ++ _exit(0); ++ } ++ ++ if (waitpid(child, &status, 0) < 0) ++ err(1, "waitpid"); ++ if (!WIFEXITED(status) || WEXITSTATUS(status) != 0) ++ errx(1, "child exited with status %d", WEXITSTATUS(status)); ++ ++ child = fork(); ++ if (child < 0) ++ err(1, "fork"); ++ if (child == 0) { ++ struct winsize winsz; ++ ++ if (setsid() < 0) ++ err(1, "setsid"); ++ slave = open(ptsname(master), O_RDWR | O_NOCTTY); ++ if (slave < 0) ++ err(2, "open"); ++ /* Dereferences dangling t_pgrp pointer in the terminal. */ ++ memset(&winsz, 0xff, sizeof(winsz)); ++ if (ioctl(slave, TIOCSWINSZ, &winsz) < 0) ++ err(3, "ioctl(TIOCSWINSZ)"); ++ /* Dereferences dangling t_session pointer in the terminal. */ ++ if (ioctl(slave, TIOCSCTTY, 0) < 0) ++ err(4, "ioctl(TIOCSCTTY)"); ++ _exit(0); ++ } ++ ++ if (waitpid(child, &status, 0) < 0) ++ err(1, "waitpid"); ++ if (!WIFEXITED(status) || WEXITSTATUS(status) != 0) ++ errx(1, "child exited with status %d", WEXITSTATUS(status)); ++} diff --git a/website/static/security/patches/SA-26:10/tty-14.3.patch.asc b/website/static/security/patches/SA-26:10/tty-14.3.patch.asc new file mode 100644 index 0000000000..c3e58c7a64 --- /dev/null +++ b/website/static/security/patches/SA-26:10/tty-14.3.patch.asc @@ -0,0 +1,16 @@ +-----BEGIN PGP SIGNATURE----- + +iQIzBAABCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmnnoaYACgkQbljekB8A +Gu9pbQ/9GDR+iPv77e1nzCl2PNDRWftlTUIoh8Do3C4sHDG3nv1uMYOkdN4EINzE +ELxPaqgSCBSXQN8ehGAxNBUuSYhbdgjVE1bTTZ61sMpm6A0BsXeLMkZq5liI/1pp +T+qsh8ZvQbJDH5PWdgvUUb8mxvhs4DOP4F579hPckPFN3c9HYIpTMyTAjBMCsi0H +sMenxDMwei0SEA71nYr5bCFov6utUdqInb51hf6oE/zhf8dTgsFLye3PN4laDvfM +9kiapV6uWQqn+XH5Hg7c5P/6eHu6PMr8lCqxRwQeahKpmw1CcuRvtkJHhVBQYAqn +b5Wka6TBqC90Q0X9STahjWD7NmVLcD6Ly4e8+jzAeDt0GrYOSilQ2sSVdYrNJTRI +dnJctpeOUlLgLHAxctuwIwC/IohkEdtTtn/QbiZKdM12aPACm768DA+Gc5GVVukq +5HeSjcnSHIBBg7g5m/cWlNrr4Y8Kt1uFBRf9xet0k04qmlMGtAaYjmbtn1s/nGZi +PG9V1LyzDd5nj7feuWlkShzb7mLGaWIVFMnnu8MqhxcTeE89JGLLweaIPLR9Mic1 +ZPWPl6YB/hhHnR3VpyyboxPE2IYjrTFQV15uMIBLH0SCCUrNeCErUBtTRvVGbCD8 +X4a1jJ9xuIG36ljWg3S9poxZjxGsUcGzYvwsOEXiqvPzJrmH3UQ= +=q/W8 +-----END PGP SIGNATURE----- diff --git a/website/static/security/patches/SA-26:10/tty-14.4.patch b/website/static/security/patches/SA-26:10/tty-14.4.patch new file mode 100644 index 0000000000..2b2df9b3df --- /dev/null +++ b/website/static/security/patches/SA-26:10/tty-14.4.patch @@ -0,0 +1,108 @@ +--- sys/kern/tty.c.orig ++++ sys/kern/tty.c +@@ -1262,6 +1262,10 @@ + session->s_ttydp = NULL; + SESS_UNLOCK(session); + ++ if (tp->t_session == session) { ++ tp->t_session = NULL; ++ tp->t_pgrp = NULL; ++ } + tp->t_sessioncnt--; + p->p_flag &= ~P_CONTROLT; + PROC_UNLOCK(p); +--- tests/sys/kern/tty/Makefile.orig ++++ tests/sys/kern/tty/Makefile +@@ -5,6 +5,7 @@ + PLAIN_TESTS_PORCH+= test_canon_fullbuf + PLAIN_TESTS_PORCH+= test_ncanon + PLAIN_TESTS_PORCH+= test_recanon ++PLAIN_TESTS_C+= tiocnotty + ATF_TESTS_C+= test_sti + + PROGS+= fionread +--- /dev/null ++++ tests/sys/kern/tty/tiocnotty.c +@@ -0,0 +1,82 @@ ++/* ++ * Copyright (c) 2026 Mark Johnston ++ * ++ * SPDX-License-Identifier: BSD-2-Clause ++ */ ++ ++/* ++ * A regression test that exercises a bug where TIOCNOTTY would leave some ++ * dangling pointers behind in the controlling terminal structure. ++ */ ++ ++#include ++#include ++ ++#include ++#include ++#include ++#include ++#include ++ ++int ++main(void) ++{ ++ int master, slave, status; ++ pid_t child; ++ ++ master = posix_openpt(O_RDWR | O_NOCTTY); ++ if (master < 0) ++ err(1, "posix_openpt"); ++ if (grantpt(master) < 0) ++ err(1, "grantpt"); ++ if (unlockpt(master) < 0) ++ err(1, "unlockpt"); ++ ++ child = fork(); ++ if (child < 0) ++ err(1, "fork"); ++ if (child == 0) { ++ if (setsid() < 0) ++ err(1, "setsid"); ++ slave = open(ptsname(master), O_RDWR | O_NOCTTY); ++ if (slave < 0) ++ err(2, "open"); ++ if (ioctl(slave, TIOCSCTTY, 0) < 0) ++ err(3, "ioctl(TIOCSCTTY)"); ++ /* Detach ourselves from the controlling terminal. */ ++ if (ioctl(slave, TIOCNOTTY, 0) < 0) ++ err(4, "ioctl(TIOCNOTTY)"); ++ _exit(0); ++ } ++ ++ if (waitpid(child, &status, 0) < 0) ++ err(1, "waitpid"); ++ if (!WIFEXITED(status) || WEXITSTATUS(status) != 0) ++ errx(1, "child exited with status %d", WEXITSTATUS(status)); ++ ++ child = fork(); ++ if (child < 0) ++ err(1, "fork"); ++ if (child == 0) { ++ struct winsize winsz; ++ ++ if (setsid() < 0) ++ err(1, "setsid"); ++ slave = open(ptsname(master), O_RDWR | O_NOCTTY); ++ if (slave < 0) ++ err(2, "open"); ++ /* Dereferences dangling t_pgrp pointer in the terminal. */ ++ memset(&winsz, 0xff, sizeof(winsz)); ++ if (ioctl(slave, TIOCSWINSZ, &winsz) < 0) ++ err(3, "ioctl(TIOCSWINSZ)"); ++ /* Dereferences dangling t_session pointer in the terminal. */ ++ if (ioctl(slave, TIOCSCTTY, 0) < 0) ++ err(4, "ioctl(TIOCSCTTY)"); ++ _exit(0); ++ } ++ ++ if (waitpid(child, &status, 0) < 0) ++ err(1, "waitpid"); ++ if (!WIFEXITED(status) || WEXITSTATUS(status) != 0) ++ errx(1, "child exited with status %d", WEXITSTATUS(status)); ++} diff --git a/website/static/security/patches/SA-26:10/tty-14.4.patch.asc b/website/static/security/patches/SA-26:10/tty-14.4.patch.asc new file mode 100644 index 0000000000..fc58ad821d --- /dev/null +++ b/website/static/security/patches/SA-26:10/tty-14.4.patch.asc @@ -0,0 +1,16 @@ +-----BEGIN PGP SIGNATURE----- + +iQIzBAABCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmnnoacACgkQbljekB8A +Gu+C+Q/9G2j2xy3jibzA6BOGhW5P74e7d7Ew/iLh+9cLUMtOYkxbhhEe+iZoagFM +TfHgtBrZOYi1E3PrpI1dUyRCJocH7IpZgmQq1hQUlMjUWyycGWwjgqeIuv5D8qCJ +DP88551FmBDwE/WDdWFKoWWVraSWMDKG7GZVkGn60ahe77ICH4Ttck4OzxJMr3dv +3ixAUeYtyWGD3vCepB0CtDwsB5Y9cavFIVv5bnMeW8RYb6l872jYkOJUrySqhfiH +2fpbLRG07ULn+KaIPnonuY1i5UZV3tu7l1DWN2bDEyN4i17jXZI6zNQJYg6MPiUV +v3LT4RzV9tPzT98m341Ws+rNJ6T1X8gYCfNV+hx3Qq/yaCFruc9L+RxUnNEjJzxq +T5wGtU8FRQJGzzdH75zv7HGg/qL/5toHh9RfTU3g5AWd6F1TteUOTs7fj+06K6B/ +fRbDFg2sLaJUPVYYhM5GniWxOvYmKuahUCgIx1MHiLs7IJE/Yg70m/zBTlqIQAv7 +g9huqNu95WltJFmBuyXDG+o6BgA3EkN6wgcCbSpndSriFTIzmurguIrNXp+jx+4q +4pvPPb6UWr1EKr8b6EyCWkcTgqixOHZvUG3SN78tAAc6vzcabVIXh6dHPI7Pca+h +n1Za8e2ab1ECrBgBKVbrUqo7W11Pb5meT/390mPFfMPRGA41mbg= +=0SAa +-----END PGP SIGNATURE----- diff --git a/website/static/security/patches/SA-26:10/tty-15.patch b/website/static/security/patches/SA-26:10/tty-15.patch new file mode 100644 index 0000000000..660e6dd58b --- /dev/null +++ b/website/static/security/patches/SA-26:10/tty-15.patch @@ -0,0 +1,108 @@ +--- sys/kern/tty.c.orig ++++ sys/kern/tty.c +@@ -1263,6 +1263,10 @@ + session->s_ttydp = NULL; + SESS_UNLOCK(session); + ++ if (tp->t_session == session) { ++ tp->t_session = NULL; ++ tp->t_pgrp = NULL; ++ } + tp->t_sessioncnt--; + p->p_flag &= ~P_CONTROLT; + PROC_UNLOCK(p); +--- tests/sys/kern/tty/Makefile.orig ++++ tests/sys/kern/tty/Makefile +@@ -5,6 +5,7 @@ + PLAIN_TESTS_PORCH+= test_canon_fullbuf + PLAIN_TESTS_PORCH+= test_ncanon + PLAIN_TESTS_PORCH+= test_recanon ++PLAIN_TESTS_C+= tiocnotty + ATF_TESTS_C+= test_sti + + PROGS+= fionread +--- /dev/null ++++ tests/sys/kern/tty/tiocnotty.c +@@ -0,0 +1,82 @@ ++/* ++ * Copyright (c) 2026 Mark Johnston ++ * ++ * SPDX-License-Identifier: BSD-2-Clause ++ */ ++ ++/* ++ * A regression test that exercises a bug where TIOCNOTTY would leave some ++ * dangling pointers behind in the controlling terminal structure. ++ */ ++ ++#include ++#include ++ ++#include ++#include ++#include ++#include ++#include ++ ++int ++main(void) ++{ ++ int master, slave, status; ++ pid_t child; ++ ++ master = posix_openpt(O_RDWR | O_NOCTTY); ++ if (master < 0) ++ err(1, "posix_openpt"); ++ if (grantpt(master) < 0) ++ err(1, "grantpt"); ++ if (unlockpt(master) < 0) ++ err(1, "unlockpt"); ++ ++ child = fork(); ++ if (child < 0) ++ err(1, "fork"); ++ if (child == 0) { ++ if (setsid() < 0) ++ err(1, "setsid"); ++ slave = open(ptsname(master), O_RDWR | O_NOCTTY); ++ if (slave < 0) ++ err(2, "open"); ++ if (ioctl(slave, TIOCSCTTY, 0) < 0) ++ err(3, "ioctl(TIOCSCTTY)"); ++ /* Detach ourselves from the controlling terminal. */ ++ if (ioctl(slave, TIOCNOTTY, 0) < 0) ++ err(4, "ioctl(TIOCNOTTY)"); ++ _exit(0); ++ } ++ ++ if (waitpid(child, &status, 0) < 0) ++ err(1, "waitpid"); ++ if (!WIFEXITED(status) || WEXITSTATUS(status) != 0) ++ errx(1, "child exited with status %d", WEXITSTATUS(status)); ++ ++ child = fork(); ++ if (child < 0) ++ err(1, "fork"); ++ if (child == 0) { ++ struct winsize winsz; ++ ++ if (setsid() < 0) ++ err(1, "setsid"); ++ slave = open(ptsname(master), O_RDWR | O_NOCTTY); ++ if (slave < 0) ++ err(2, "open"); ++ /* Dereferences dangling t_pgrp pointer in the terminal. */ ++ memset(&winsz, 0xff, sizeof(winsz)); ++ if (ioctl(slave, TIOCSWINSZ, &winsz) < 0) ++ err(3, "ioctl(TIOCSWINSZ)"); ++ /* Dereferences dangling t_session pointer in the terminal. */ ++ if (ioctl(slave, TIOCSCTTY, 0) < 0) ++ err(4, "ioctl(TIOCSCTTY)"); ++ _exit(0); ++ } ++ ++ if (waitpid(child, &status, 0) < 0) ++ err(1, "waitpid"); ++ if (!WIFEXITED(status) || WEXITSTATUS(status) != 0) ++ errx(1, "child exited with status %d", WEXITSTATUS(status)); ++} diff --git a/website/static/security/patches/SA-26:10/tty-15.patch.asc b/website/static/security/patches/SA-26:10/tty-15.patch.asc new file mode 100644 index 0000000000..f4d6c1e912 --- /dev/null +++ b/website/static/security/patches/SA-26:10/tty-15.patch.asc @@ -0,0 +1,16 @@ +-----BEGIN PGP SIGNATURE----- + +iQIzBAABCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmnnoagACgkQbljekB8A +Gu/GWQ//YLLyJhu4UoYYN/4p/Up+F9s3dyfhRvO6qnCERdnT8nS+ZZ1/oYozvVv9 +d8GYaSx+8u1kfdD/U0D9515TWygISBhJBIZNAhcILAr0Z9drtOZ4LH0PAHjEToHZ +6DLb5zjwuHJGeFwranMuNMOAeGq5uKGjgSOsq5ZEC1644kUxA0Eb1n76pI/JC8DM +ciYJLHNz5LpfymZDDp6kcpyN4W9aylwH9C5yVn+pGCuGVAeW6QtLgYnM+LIyMC7L +WuFTQdVOKI7B/7Gy/R7N/rfIYcyVtyf7oqtt4bSknQxs1KEn7GUfLZxyRS2KntSi +swpaMN8x1pdEdJGdQ7ldl1sYtEKeFTlWX0DZunR4yJT+xKR/PV3t7sgBwQwF1ebh +BLdadJVSXMCAkzdifl8lmpgyU9IOcyFEv9KbmjTE2bKY6ob9Tzq/y3yCuWRKCpbc +dcBOxRo6voNrssp6oNJpN6TFFmtgkH69RiKwOKtzJfgjgfUUEqGktmB96cpGstwG +vFwiUPjDSfvJ57WTZpsvHaNjPQrlmOniKlpnk8ilpDkX5AOtcOnW+l3vUBzBHMzq +NIgnjU6i/SSN1L0mEqGjhbYay7DZc0U284SIpmPa4wxnti4AQOr+ADHH93uQehKm +8BPnYKXzz2+MdvKDjGaOcHGwtkYojOhpIggwy/9a9cdPo2PhvaY= +=QZql +-----END PGP SIGNATURE----- diff --git a/website/static/security/patches/SA-26:11/amd64-13.patch b/website/static/security/patches/SA-26:11/amd64-13.patch new file mode 100644 index 0000000000..95b97f6e79 --- /dev/null +++ b/website/static/security/patches/SA-26:11/amd64-13.patch @@ -0,0 +1,397 @@ +--- lib/libc/x86/sys/pkru.3.orig ++++ lib/libc/x86/sys/pkru.3 +@@ -179,6 +179,9 @@ + argument for + .Fn x86_pkru_protect_range + has reserved bits set. ++.It Bq Er EINVAL ++The range of the request partially covers a mapping of an object created by ++.Xr shm_create_largepage 3 . + .It Bq Er EFAULT + The supplied address range does not completely fit into the user-managed + address range. +--- sys/amd64/amd64/pmap.c.orig ++++ sys/amd64/amd64/pmap.c +@@ -11255,7 +11255,7 @@ + u_int keyidx) + { + pml4_entry_t *pml4e; +- pdp_entry_t *pdpe; ++ pdp_entry_t newpdpe, *pdpe; + pd_entry_t newpde, ptpaddr, *pde; + pt_entry_t newpte, *ptep, pte; + vm_offset_t va, va_next; +@@ -11281,6 +11281,22 @@ + va_next = eva; + continue; + } ++ if ((*pdpe & PG_PS) != 0) { ++ va_next = (va + NBPDP) & ~PDPMASK; ++ if (va_next < va) ++ va_next = eva; ++ KASSERT(va_next <= eva, ++ ("partial update of non-transparent 1G mapping " ++ "pdpe %#lx va %#lx eva %#lx va_next %#lx", ++ *pdpe, va, eva, va_next)); ++ newpdpe = (*pdpe & ~X86_PG_PKU_MASK) | ++ X86_PG_PKU(keyidx); ++ if (newpdpe != *pdpe) { ++ *pdpe = newpdpe; ++ changed = true; ++ } ++ continue; ++ } + + va_next = (va + NBPDR) & ~PDRMASK; + if (va_next < va) +@@ -11333,8 +11349,6 @@ + if (pmap->pm_type != PT_X86 || keyidx > PMAP_MAX_PKRU_IDX || + (flags & ~(AMD64_PKRU_PERSIST | AMD64_PKRU_EXCL)) != 0) + return (EINVAL); +- if (eva <= sva || eva > VM_MAXUSER_ADDRESS) +- return (EFAULT); + if ((cpu_stdext_feature2 & CPUID_STDEXT2_PKU) == 0) + return (ENOTSUP); + return (0); +--- sys/amd64/amd64/sys_machdep.c.orig ++++ sys/amd64/amd64/sys_machdep.c +@@ -32,7 +32,6 @@ + * from: @(#)sys_machdep.c 5.5 (Berkeley) 1/19/91 + */ + +-#include + #include "opt_capsicum.h" + #include "opt_ktrace.h" + +@@ -356,32 +355,58 @@ + break; + + case I386_SET_PKRU: +- case AMD64_SET_PKRU: ++ case AMD64_SET_PKRU: { ++ vm_offset_t addr, start, end; ++ vm_size_t len; ++ ++ addr = (uintptr_t)a64pkru.addr; ++ len = a64pkru.len; ++ + /* + * Read-lock the map to synchronize with parallel + * pmap_vmspace_copy() on fork. + */ + map = &td->td_proc->p_vmspace->vm_map; + vm_map_lock_read(map); +- error = pmap_pkru_set(PCPU_GET(curpmap), +- (vm_offset_t)a64pkru.addr, (vm_offset_t)a64pkru.addr + +- a64pkru.len, a64pkru.keyidx, a64pkru.flags); ++ if (len == 0 || !vm_map_check_boundary(map, addr, addr + len)) { ++ vm_map_unlock_read(map); ++ error = EINVAL; ++ break; ++ } ++ start = trunc_page(addr); ++ end = round_page(addr + len); ++ error = pmap_pkru_set(PCPU_GET(curpmap), start, end, ++ a64pkru.keyidx, a64pkru.flags); + vm_map_unlock_read(map); + break; ++ } + + case I386_CLEAR_PKRU: +- case AMD64_CLEAR_PKRU: ++ case AMD64_CLEAR_PKRU: { ++ vm_offset_t addr, start, end; ++ vm_size_t len; ++ + if (a64pkru.flags != 0 || a64pkru.keyidx != 0) { + error = EINVAL; + break; + } ++ ++ addr = (uintptr_t)a64pkru.addr; ++ len = a64pkru.len; ++ + map = &td->td_proc->p_vmspace->vm_map; + vm_map_lock_read(map); +- error = pmap_pkru_clear(PCPU_GET(curpmap), +- (vm_offset_t)a64pkru.addr, +- (vm_offset_t)a64pkru.addr + a64pkru.len); ++ if (len == 0 || !vm_map_check_boundary(map, addr, addr + len)) { ++ vm_map_unlock_read(map); ++ error = EINVAL; ++ break; ++ } ++ start = trunc_page(addr); ++ end = round_page(addr + len); ++ error = pmap_pkru_clear(PCPU_GET(curpmap), start, end); + vm_map_unlock_read(map); + break; ++ } + + default: + error = EINVAL; +--- sys/vm/vm_map.c.orig ++++ sys/vm/vm_map.c +@@ -4116,6 +4116,38 @@ + return (TRUE); + } + ++/* ++ * Check whether the specified range partially overlaps a map entry with ++ * fixed boundaries, and return false if so. ++ * ++ * The map must be locked. ++ */ ++bool ++vm_map_check_boundary(vm_map_t map, vm_offset_t start, vm_offset_t end) ++{ ++ vm_map_entry_t entry; ++ int bdry_idx; ++ ++ if (!vm_map_range_valid(map, start, end)) ++ return (false); ++ if (start == end) ++ return (true); ++ ++ if (vm_map_lookup_entry(map, start, &entry)) { ++ bdry_idx = MAP_ENTRY_SPLIT_BOUNDARY_INDEX(entry); ++ if (bdry_idx != 0 && ++ (start & (pagesizes[bdry_idx] - 1)) != 0) ++ return (false); ++ } ++ if (vm_map_lookup_entry(map, end - 1, &entry)) { ++ bdry_idx = MAP_ENTRY_SPLIT_BOUNDARY_INDEX(entry); ++ if (bdry_idx != 0 && ++ (end & (pagesizes[bdry_idx] - 1)) != 0) ++ return (false); ++ } ++ return (true); ++} ++ + /* + * + * vm_map_copy_swap_object: +--- sys/vm/vm_map.h.orig ++++ sys/vm/vm_map.h +@@ -469,6 +469,7 @@ + #endif /* ! _KERNEL */ + + #ifdef _KERNEL ++bool vm_map_check_boundary(vm_map_t, vm_offset_t, vm_offset_t); + boolean_t vm_map_check_protection (vm_map_t, vm_offset_t, vm_offset_t, vm_prot_t); + int vm_map_delete(vm_map_t, vm_offset_t, vm_offset_t); + int vm_map_find(vm_map_t, vm_object_t, vm_ooffset_t, vm_offset_t *, vm_size_t, +--- tests/sys/posixshm/posixshm_test.c.orig ++++ tests/sys/posixshm/posixshm_test.c +@@ -34,10 +34,17 @@ + #include + #include + ++#ifdef __amd64__ ++#include ++#endif ++ + #include + #include + #include ++#include ++#include + #include ++#include + #include + #include + #include +@@ -1702,6 +1709,183 @@ + } + } + ++#ifdef __amd64__ ++static sigjmp_buf jmpbuf; ++static _Atomic(void *) faultaddr; ++static _Atomic(int) faultsig; ++ ++#define KEY_RW 1 ++#define KEY_RO 2 ++#define KEY_WO 3 ++#define KEY_NO 4 ++#define VAL 0xdeadfacec0debeef ++static void ++set_keys(void) ++{ ++ int error; ++ ++ error = x86_pkru_set_perm(KEY_RW, 1, 1); ++ ATF_REQUIRE(error == 0); ++ error = x86_pkru_set_perm(KEY_RO, 1, 0); ++ ATF_REQUIRE(error == 0); ++ error = x86_pkru_set_perm(KEY_WO, 0, 1); ++ ATF_REQUIRE(error == 0); ++ error = x86_pkru_set_perm(KEY_NO, 0, 0); ++ ATF_REQUIRE(error == 0); ++} ++ ++static void ++sigsegv(int sig, siginfo_t *si, void *uc __unused) ++{ ++ faultsig = sig; ++ faultaddr = si->si_addr; ++ siglongjmp(jmpbuf, 1); ++} ++ ++static bool ++try_read(volatile uint64_t *p, uint64_t *outp) ++{ ++ if (sigsetjmp(jmpbuf, 1) == 0) { ++ *outp = *p; ++ return (true); ++ } else { ++ atomic_signal_fence(memory_order_relaxed); ++ ATF_REQUIRE(faultsig == SIGSEGV); ++ ATF_REQUIRE(faultaddr == p); ++ set_keys(); /* PKRU is not restored by siglongjmp? */ ++ return (false); ++ } ++} ++ ++static bool ++try_write(volatile uint64_t *p, uint64_t val) ++{ ++ if (sigsetjmp(jmpbuf, 1) == 0) { ++ *p = val; ++ return (true); ++ } else { ++ atomic_signal_fence(memory_order_relaxed); ++ ATF_REQUIRE(faultsig == SIGSEGV); ++ ATF_REQUIRE(faultaddr == p); ++ set_keys(); /* PKRU is not restored by siglongjmp? */ ++ return (false); ++ } ++} ++ ++ATF_TC_WITHOUT_HEAD(largepage_pkru); ++ATF_TC_BODY(largepage_pkru, tc) ++{ ++ size_t ps[MAXPAGESIZES]; ++ struct sigaction sa; ++ char *addr, *addr1; ++ int error, fd, pscnt; ++ ++ memset(&sa, 0, sizeof(sa)); ++ sa.sa_sigaction = sigsegv; ++ sa.sa_flags = SA_SIGINFO; ++ sigemptyset(&sa.sa_mask); ++ error = sigaction(SIGSEGV, &sa, NULL); ++ ATF_REQUIRE(error == 0); ++ ++ pscnt = pagesizes(ps); ++ ++ for (int i = 1; i < pscnt; i++) { ++ uint64_t val; ++ ++ fd = shm_open_large(i, SHM_LARGEPAGE_ALLOC_DEFAULT, ps[i]); ++ addr = mmap(NULL, ps[i], PROT_READ | PROT_WRITE, MAP_SHARED, fd, ++ 0); ++ ATF_REQUIRE_MSG(addr != MAP_FAILED, ++ "mmap(%zu bytes) failed; error=%d", ps[i], errno); ++ ++ /* ++ * Ensure that the page is faulted into the pmap. ++ */ ++ memset(addr, 0, ps[i]); ++ ++ set_keys(); ++ ++ /* ++ * Make sure we can't partially cover a largepage mapping. ++ */ ++ error = x86_pkru_protect_range(addr, PAGE_SIZE, KEY_RW, 0); ++ ATF_REQUIRE_ERRNO(EINVAL, error != 0); ++ error = x86_pkru_protect_range(addr, ps[i] - PAGE_SIZE, KEY_RW, ++ 0); ++ ATF_REQUIRE_ERRNO(EINVAL, error != 0); ++ error = x86_pkru_protect_range(addr + PAGE_SIZE, ps[i] - PAGE_SIZE, ++ KEY_RW, 0); ++ ATF_REQUIRE_ERRNO(EINVAL, error != 0); ++ error = x86_pkru_protect_range(addr + 1, ps[i], KEY_RW, 0); ++ ATF_REQUIRE_ERRNO(EINVAL, error != 0); ++ ++ /* ++ * Make sure that protections are honoured. ++ */ ++ for (int j = 1; j <= 4; j++) { ++ volatile uint64_t *addr64; ++ ++ error = x86_pkru_protect_range(addr, ps[i], 0, 0); ++ ATF_REQUIRE(error == 0); ++ ++ addr64 = (volatile uint64_t *)(void *)addr; ++ *addr64 = VAL; ++ ++ error = x86_pkru_protect_range(addr, ps[i], j, 0); ++ ATF_REQUIRE(error == 0); ++ switch (j) { ++ case KEY_RW: ++ ATF_REQUIRE(try_write(addr64, VAL)); ++ ATF_REQUIRE(try_read(addr64, &val)); ++ ATF_REQUIRE(val == VAL); ++ break; ++ case KEY_RO: ++ ATF_REQUIRE(try_read(addr64, &val)); ++ ATF_REQUIRE(val == VAL); ++ ATF_REQUIRE(!try_write(addr64, VAL)); ++ break; ++ case KEY_WO: ++ /* !access implies !modify */ ++ case KEY_NO: ++ ATF_REQUIRE(!try_read(addr64, &val)); ++ ATF_REQUIRE(!try_write(addr64, VAL)); ++ break; ++ default: ++ __unreachable(); ++ } ++ } ++ error = munmap(addr, ps[i]); ++ ATF_CHECK(error == 0); ++ ++ /* ++ * Try mapping a large page in a region partially covered by a ++ * key. ++ * ++ * Rather than detecting the mismatch when the logical mapping ++ * is created, we currently only fail once pmap_enter() is ++ * called from the fault handler. This is not ideal and might ++ * be improved in the future. ++ */ ++ error = x86_pkru_protect_range(addr, ps[i], 0, 0); ++ ATF_REQUIRE(error == 0); ++ error = x86_pkru_protect_range(addr + PAGE_SIZE, ++ ps[i] - PAGE_SIZE, KEY_RW, 0); ++ ATF_REQUIRE(error == 0); ++ ++ addr1 = mmap(addr, ps[i], PROT_READ | PROT_WRITE, ++ MAP_SHARED | MAP_FIXED, fd, 0); ++ ATF_REQUIRE(addr1 != MAP_FAILED); ++ ATF_REQUIRE(addr == addr1); ++ ATF_REQUIRE(!try_read((volatile uint64_t *)(void *)addr, &val)); ++ ATF_REQUIRE(!try_write((volatile uint64_t *)(void *)addr, VAL)); ++ } ++} ++#undef KEY_RW ++#undef KEY_RO ++#undef KEY_WO ++#undef KEY_NO ++#endif ++ + ATF_TC_WITHOUT_HEAD(largepage_reopen); + ATF_TC_BODY(largepage_reopen, tc) + { +@@ -1791,6 +1975,9 @@ + ATF_TP_ADD_TC(tp, largepage_mprotect); + ATF_TP_ADD_TC(tp, largepage_minherit); + ATF_TP_ADD_TC(tp, largepage_pipe); ++#ifdef __amd64__ ++ ATF_TP_ADD_TC(tp, largepage_pkru); ++#endif + ATF_TP_ADD_TC(tp, largepage_reopen); + + return (atf_no_error()); diff --git a/website/static/security/patches/SA-26:11/amd64-13.patch.asc b/website/static/security/patches/SA-26:11/amd64-13.patch.asc new file mode 100644 index 0000000000..afc74bab6b --- /dev/null +++ b/website/static/security/patches/SA-26:11/amd64-13.patch.asc @@ -0,0 +1,16 @@ +-----BEGIN PGP SIGNATURE----- + +iQIzBAABCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmnnoasACgkQbljekB8A +Gu+hSBAAn7ymG70uRhOZuB/b3yO6Wa7NBAMPX6JslR97Er2MVWkgRwLEWf9vDutn +o7vXt5KcqocJO/YjJJSyMyCkkLykIu+Ak7tCmQL6TohwnYoRNiXgKOnWvKv4YoKp +0MMrULLANIf1aVZDHcuBYNbp84OZiLkdHwkNVY2j62+Pt3ghHSDb6xhSlw9EY816 +yJ4GdJpcPXfruglnbJQG4j/Gg/M2iAYp5Z5Do6/zDrQ/oM76H9RhX4+Crp57iZRD +vVYmrHAfNzG3Gmmk5W8NLLe8Ys03rUXizhqrLCYbiEbyHIil0NWqzSPBVO6fJFPM +TBsAAd8ym1S65HLp/PzQJHkPNyCoT5PR3b+u65FDX/iJDFJWS9zEtr/Mem6LFkZL +vCrK2GLkW31dCT3bKGHEXTpKRWBobWXBfpYYy9RZR9p1n0kfGVvvHZNvFZpBar/F +UAIzpFMb0wS1k7Njw7GeOl3AQPinj1zZcoGijEVb1a9RUyq9oTMMVqpAViunRoOT +Vzq3WOfaj6byRq6+8xYf6sHwT1nAXxxQoqVxMKGG5E0Np2BCwKvrgSUEGM80k3aA +rjEJk65DIW0wK1vuTg9Wzlz3ocybvguKT6JHd410gTymi3pQwg0TEmIqQX/pHyU9 +4zmCRqgWOr6urcg1RxkCWYqCkKgYK6U2Iw35Fh5XUbXfPPckGAo= +=Vdvx +-----END PGP SIGNATURE----- diff --git a/website/static/security/patches/SA-26:11/amd64-14.patch b/website/static/security/patches/SA-26:11/amd64-14.patch new file mode 100644 index 0000000000..90a95516f8 --- /dev/null +++ b/website/static/security/patches/SA-26:11/amd64-14.patch @@ -0,0 +1,397 @@ +--- lib/libc/x86/sys/pkru.3.orig ++++ lib/libc/x86/sys/pkru.3 +@@ -179,6 +179,9 @@ + argument for + .Fn x86_pkru_protect_range + has reserved bits set. ++.It Bq Er EINVAL ++The range of the request partially covers a mapping of an object created by ++.Xr shm_create_largepage 3 . + .It Bq Er EFAULT + The supplied address range does not completely fit into the user-managed + address range. +--- sys/amd64/amd64/pmap.c.orig ++++ sys/amd64/amd64/pmap.c +@@ -11598,7 +11598,7 @@ + u_int keyidx) + { + pml4_entry_t *pml4e; +- pdp_entry_t *pdpe; ++ pdp_entry_t newpdpe, *pdpe; + pd_entry_t newpde, ptpaddr, *pde; + pt_entry_t newpte, *ptep, pte; + vm_offset_t va, va_next; +@@ -11624,6 +11624,22 @@ + va_next = eva; + continue; + } ++ if ((*pdpe & PG_PS) != 0) { ++ va_next = (va + NBPDP) & ~PDPMASK; ++ if (va_next < va) ++ va_next = eva; ++ KASSERT(va_next <= eva, ++ ("partial update of non-transparent 1G mapping " ++ "pdpe %#lx va %#lx eva %#lx va_next %#lx", ++ *pdpe, va, eva, va_next)); ++ newpdpe = (*pdpe & ~X86_PG_PKU_MASK) | ++ X86_PG_PKU(keyidx); ++ if (newpdpe != *pdpe) { ++ *pdpe = newpdpe; ++ changed = true; ++ } ++ continue; ++ } + + va_next = (va + NBPDR) & ~PDRMASK; + if (va_next < va) +@@ -11676,8 +11692,6 @@ + if (pmap->pm_type != PT_X86 || keyidx > PMAP_MAX_PKRU_IDX || + (flags & ~(AMD64_PKRU_PERSIST | AMD64_PKRU_EXCL)) != 0) + return (EINVAL); +- if (eva <= sva || eva > VM_MAXUSER_ADDRESS) +- return (EFAULT); + if ((cpu_stdext_feature2 & CPUID_STDEXT2_PKU) == 0) + return (ENOTSUP); + return (0); +--- sys/amd64/amd64/sys_machdep.c.orig ++++ sys/amd64/amd64/sys_machdep.c +@@ -32,7 +32,6 @@ + * from: @(#)sys_machdep.c 5.5 (Berkeley) 1/19/91 + */ + +-#include + #include "opt_capsicum.h" + #include "opt_ktrace.h" + +@@ -371,32 +370,58 @@ + break; + + case I386_SET_PKRU: +- case AMD64_SET_PKRU: ++ case AMD64_SET_PKRU: { ++ vm_offset_t addr, start, end; ++ vm_size_t len; ++ ++ addr = (uintptr_t)a64pkru.addr; ++ len = a64pkru.len; ++ + /* + * Read-lock the map to synchronize with parallel + * pmap_vmspace_copy() on fork. + */ + map = &td->td_proc->p_vmspace->vm_map; + vm_map_lock_read(map); +- error = pmap_pkru_set(PCPU_GET(curpmap), +- (vm_offset_t)a64pkru.addr, (vm_offset_t)a64pkru.addr + +- a64pkru.len, a64pkru.keyidx, a64pkru.flags); ++ if (len == 0 || !vm_map_check_boundary(map, addr, addr + len)) { ++ vm_map_unlock_read(map); ++ error = EINVAL; ++ break; ++ } ++ start = trunc_page(addr); ++ end = round_page(addr + len); ++ error = pmap_pkru_set(PCPU_GET(curpmap), start, end, ++ a64pkru.keyidx, a64pkru.flags); + vm_map_unlock_read(map); + break; ++ } + + case I386_CLEAR_PKRU: +- case AMD64_CLEAR_PKRU: ++ case AMD64_CLEAR_PKRU: { ++ vm_offset_t addr, start, end; ++ vm_size_t len; ++ + if (a64pkru.flags != 0 || a64pkru.keyidx != 0) { + error = EINVAL; + break; + } ++ ++ addr = (uintptr_t)a64pkru.addr; ++ len = a64pkru.len; ++ + map = &td->td_proc->p_vmspace->vm_map; + vm_map_lock_read(map); +- error = pmap_pkru_clear(PCPU_GET(curpmap), +- (vm_offset_t)a64pkru.addr, +- (vm_offset_t)a64pkru.addr + a64pkru.len); ++ if (len == 0 || !vm_map_check_boundary(map, addr, addr + len)) { ++ vm_map_unlock_read(map); ++ error = EINVAL; ++ break; ++ } ++ start = trunc_page(addr); ++ end = round_page(addr + len); ++ error = pmap_pkru_clear(PCPU_GET(curpmap), start, end); + vm_map_unlock_read(map); + break; ++ } + + case AMD64_DISABLE_TLSBASE: + clear_pcb_flags(pcb, PCB_TLSBASE); +--- sys/vm/vm_map.c.orig ++++ sys/vm/vm_map.c +@@ -4140,6 +4140,38 @@ + return (TRUE); + } + ++/* ++ * Check whether the specified range partially overlaps a map entry with ++ * fixed boundaries, and return false if so. ++ * ++ * The map must be locked. ++ */ ++bool ++vm_map_check_boundary(vm_map_t map, vm_offset_t start, vm_offset_t end) ++{ ++ vm_map_entry_t entry; ++ int bdry_idx; ++ ++ if (!vm_map_range_valid(map, start, end)) ++ return (false); ++ if (start == end) ++ return (true); ++ ++ if (vm_map_lookup_entry(map, start, &entry)) { ++ bdry_idx = MAP_ENTRY_SPLIT_BOUNDARY_INDEX(entry); ++ if (bdry_idx != 0 && ++ (start & (pagesizes[bdry_idx] - 1)) != 0) ++ return (false); ++ } ++ if (vm_map_lookup_entry(map, end - 1, &entry)) { ++ bdry_idx = MAP_ENTRY_SPLIT_BOUNDARY_INDEX(entry); ++ if (bdry_idx != 0 && ++ (end & (pagesizes[bdry_idx] - 1)) != 0) ++ return (false); ++ } ++ return (true); ++} ++ + /* + * + * vm_map_copy_swap_object: +--- sys/vm/vm_map.h.orig ++++ sys/vm/vm_map.h +@@ -471,6 +471,7 @@ + #endif /* ! _KERNEL */ + + #ifdef _KERNEL ++bool vm_map_check_boundary(vm_map_t, vm_offset_t, vm_offset_t); + boolean_t vm_map_check_protection (vm_map_t, vm_offset_t, vm_offset_t, vm_prot_t); + int vm_map_delete(vm_map_t, vm_offset_t, vm_offset_t); + int vm_map_find(vm_map_t, vm_object_t, vm_ooffset_t, vm_offset_t *, vm_size_t, +--- tests/sys/posixshm/posixshm_test.c.orig ++++ tests/sys/posixshm/posixshm_test.c +@@ -39,10 +39,17 @@ + #include + #include + ++#ifdef __amd64__ ++#include ++#endif ++ + #include + #include + #include ++#include ++#include + #include ++#include + #include + #include + #include +@@ -1902,6 +1909,183 @@ + } + } + ++#ifdef __amd64__ ++static sigjmp_buf jmpbuf; ++static _Atomic(void *) faultaddr; ++static _Atomic(int) faultsig; ++ ++#define KEY_RW 1 ++#define KEY_RO 2 ++#define KEY_WO 3 ++#define KEY_NO 4 ++#define VAL 0xdeadfacec0debeef ++static void ++set_keys(void) ++{ ++ int error; ++ ++ error = x86_pkru_set_perm(KEY_RW, 1, 1); ++ ATF_REQUIRE(error == 0); ++ error = x86_pkru_set_perm(KEY_RO, 1, 0); ++ ATF_REQUIRE(error == 0); ++ error = x86_pkru_set_perm(KEY_WO, 0, 1); ++ ATF_REQUIRE(error == 0); ++ error = x86_pkru_set_perm(KEY_NO, 0, 0); ++ ATF_REQUIRE(error == 0); ++} ++ ++static void ++sigsegv(int sig, siginfo_t *si, void *uc __unused) ++{ ++ faultsig = sig; ++ faultaddr = si->si_addr; ++ siglongjmp(jmpbuf, 1); ++} ++ ++static bool ++try_read(volatile uint64_t *p, uint64_t *outp) ++{ ++ if (sigsetjmp(jmpbuf, 1) == 0) { ++ *outp = *p; ++ return (true); ++ } else { ++ atomic_signal_fence(memory_order_relaxed); ++ ATF_REQUIRE(faultsig == SIGSEGV); ++ ATF_REQUIRE(faultaddr == p); ++ set_keys(); /* PKRU is not restored by siglongjmp? */ ++ return (false); ++ } ++} ++ ++static bool ++try_write(volatile uint64_t *p, uint64_t val) ++{ ++ if (sigsetjmp(jmpbuf, 1) == 0) { ++ *p = val; ++ return (true); ++ } else { ++ atomic_signal_fence(memory_order_relaxed); ++ ATF_REQUIRE(faultsig == SIGSEGV); ++ ATF_REQUIRE(faultaddr == p); ++ set_keys(); /* PKRU is not restored by siglongjmp? */ ++ return (false); ++ } ++} ++ ++ATF_TC_WITHOUT_HEAD(largepage_pkru); ++ATF_TC_BODY(largepage_pkru, tc) ++{ ++ size_t ps[MAXPAGESIZES]; ++ struct sigaction sa; ++ char *addr, *addr1; ++ int error, fd, pscnt; ++ ++ memset(&sa, 0, sizeof(sa)); ++ sa.sa_sigaction = sigsegv; ++ sa.sa_flags = SA_SIGINFO; ++ sigemptyset(&sa.sa_mask); ++ error = sigaction(SIGSEGV, &sa, NULL); ++ ATF_REQUIRE(error == 0); ++ ++ pscnt = pagesizes(ps); ++ ++ for (int i = 1; i < pscnt; i++) { ++ uint64_t val; ++ ++ fd = shm_open_large(i, SHM_LARGEPAGE_ALLOC_DEFAULT, ps[i]); ++ addr = mmap(NULL, ps[i], PROT_READ | PROT_WRITE, MAP_SHARED, fd, ++ 0); ++ ATF_REQUIRE_MSG(addr != MAP_FAILED, ++ "mmap(%zu bytes) failed; error=%d", ps[i], errno); ++ ++ /* ++ * Ensure that the page is faulted into the pmap. ++ */ ++ memset(addr, 0, ps[i]); ++ ++ set_keys(); ++ ++ /* ++ * Make sure we can't partially cover a largepage mapping. ++ */ ++ error = x86_pkru_protect_range(addr, PAGE_SIZE, KEY_RW, 0); ++ ATF_REQUIRE_ERRNO(EINVAL, error != 0); ++ error = x86_pkru_protect_range(addr, ps[i] - PAGE_SIZE, KEY_RW, ++ 0); ++ ATF_REQUIRE_ERRNO(EINVAL, error != 0); ++ error = x86_pkru_protect_range(addr + PAGE_SIZE, ps[i] - PAGE_SIZE, ++ KEY_RW, 0); ++ ATF_REQUIRE_ERRNO(EINVAL, error != 0); ++ error = x86_pkru_protect_range(addr + 1, ps[i], KEY_RW, 0); ++ ATF_REQUIRE_ERRNO(EINVAL, error != 0); ++ ++ /* ++ * Make sure that protections are honoured. ++ */ ++ for (int j = 1; j <= 4; j++) { ++ volatile uint64_t *addr64; ++ ++ error = x86_pkru_protect_range(addr, ps[i], 0, 0); ++ ATF_REQUIRE(error == 0); ++ ++ addr64 = (volatile uint64_t *)(void *)addr; ++ *addr64 = VAL; ++ ++ error = x86_pkru_protect_range(addr, ps[i], j, 0); ++ ATF_REQUIRE(error == 0); ++ switch (j) { ++ case KEY_RW: ++ ATF_REQUIRE(try_write(addr64, VAL)); ++ ATF_REQUIRE(try_read(addr64, &val)); ++ ATF_REQUIRE(val == VAL); ++ break; ++ case KEY_RO: ++ ATF_REQUIRE(try_read(addr64, &val)); ++ ATF_REQUIRE(val == VAL); ++ ATF_REQUIRE(!try_write(addr64, VAL)); ++ break; ++ case KEY_WO: ++ /* !access implies !modify */ ++ case KEY_NO: ++ ATF_REQUIRE(!try_read(addr64, &val)); ++ ATF_REQUIRE(!try_write(addr64, VAL)); ++ break; ++ default: ++ __unreachable(); ++ } ++ } ++ error = munmap(addr, ps[i]); ++ ATF_CHECK(error == 0); ++ ++ /* ++ * Try mapping a large page in a region partially covered by a ++ * key. ++ * ++ * Rather than detecting the mismatch when the logical mapping ++ * is created, we currently only fail once pmap_enter() is ++ * called from the fault handler. This is not ideal and might ++ * be improved in the future. ++ */ ++ error = x86_pkru_protect_range(addr, ps[i], 0, 0); ++ ATF_REQUIRE(error == 0); ++ error = x86_pkru_protect_range(addr + PAGE_SIZE, ++ ps[i] - PAGE_SIZE, KEY_RW, 0); ++ ATF_REQUIRE(error == 0); ++ ++ addr1 = mmap(addr, ps[i], PROT_READ | PROT_WRITE, ++ MAP_SHARED | MAP_FIXED, fd, 0); ++ ATF_REQUIRE(addr1 != MAP_FAILED); ++ ATF_REQUIRE(addr == addr1); ++ ATF_REQUIRE(!try_read((volatile uint64_t *)(void *)addr, &val)); ++ ATF_REQUIRE(!try_write((volatile uint64_t *)(void *)addr, VAL)); ++ } ++} ++#undef KEY_RW ++#undef KEY_RO ++#undef KEY_WO ++#undef KEY_NO ++#endif ++ + ATF_TC_WITHOUT_HEAD(largepage_reopen); + ATF_TC_BODY(largepage_reopen, tc) + { +@@ -1992,6 +2176,9 @@ + ATF_TP_ADD_TC(tp, largepage_mprotect); + ATF_TP_ADD_TC(tp, largepage_minherit); + ATF_TP_ADD_TC(tp, largepage_pipe); ++#ifdef __amd64__ ++ ATF_TP_ADD_TC(tp, largepage_pkru); ++#endif + ATF_TP_ADD_TC(tp, largepage_reopen); + + return (atf_no_error()); diff --git a/website/static/security/patches/SA-26:11/amd64-14.patch.asc b/website/static/security/patches/SA-26:11/amd64-14.patch.asc new file mode 100644 index 0000000000..84857f46a1 --- /dev/null +++ b/website/static/security/patches/SA-26:11/amd64-14.patch.asc @@ -0,0 +1,16 @@ +-----BEGIN PGP SIGNATURE----- + +iQIzBAABCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmnnoawACgkQbljekB8A +Gu/iIhAApnDKPpojyoXKgdTxG8nQMRAZOj5uiMmAHrGMMMhmh8TzhGfhlSeyYrp2 +oxEQlrutS7HEkyPDfN4mcE4OLWZH2vMqEWYx3fA73RvsWkocCreiDVqdx8uFn3Wy +TjkH1Ju+1pJCsLsircFEArb/3mQ7qNMw0NbqJTHt/f3Iv9KdW7U07RD4YCy7J6wf +tqGiIHfmq8s23+2rzTf+/JaSskkTMkNAM4jv+aCQ9qkenADk0eZPXD8dXIeNKL4T +7K1IqYhGNg9Njyqpg39NM4pcFoyD4r4snbBZolcx3XyepMR8w4koJVDAuauo4I3d +nNwEP7aJ4Z6Fiv0H7bOwJdLYw5BD+DJsQ4DaY7CpSpzQmRF/wrHtK0BFu1Nhkq3p +T70BIRdOE0tuEF87AQDdGmIdbNywgOuQmzVI526g4CKqVmdtX389Tfhvfy0N5VpB +H4PfgGNuIWx2liRnKcjdGTSywxo/B2+NlcgUpC3QOm0Y3i2/OZPM850UJ0IBNG6r +hn4Vr7gJLAQ/bMA2SsBD+jtI1kiK5qelx2E7dVND3DCXIItIn+ljFNgU8qtYuz/D +exmoYFp0djkm5Ap4BXHxDOLZyln8lNlzlJJfP+v89IgBen2HTDAFMEm/5GgoIpgT +FRXM+X9sCqrgaimpUnmQKueFQGZS8J1+Rh3O2x46PV818Hem68Q= +=qZnW +-----END PGP SIGNATURE----- diff --git a/website/static/security/patches/SA-26:11/amd64-15.patch b/website/static/security/patches/SA-26:11/amd64-15.patch new file mode 100644 index 0000000000..4f894028f1 --- /dev/null +++ b/website/static/security/patches/SA-26:11/amd64-15.patch @@ -0,0 +1,397 @@ +--- lib/libsys/x86/pkru.3.orig ++++ lib/libsys/x86/pkru.3 +@@ -179,6 +179,9 @@ + argument for + .Fn x86_pkru_protect_range + has reserved bits set. ++.It Bq Er EINVAL ++The range of the request partially covers a mapping of an object created by ++.Xr shm_create_largepage 3 . + .It Bq Er EFAULT + The supplied address range does not completely fit into the user-managed + address range. +--- sys/amd64/amd64/pmap.c.orig ++++ sys/amd64/amd64/pmap.c +@@ -11551,7 +11551,7 @@ + u_int keyidx) + { + pml4_entry_t *pml4e; +- pdp_entry_t *pdpe; ++ pdp_entry_t newpdpe, *pdpe; + pd_entry_t newpde, ptpaddr, *pde; + pt_entry_t newpte, *ptep, pte; + vm_offset_t va, va_next; +@@ -11577,6 +11577,22 @@ + va_next = eva; + continue; + } ++ if ((*pdpe & PG_PS) != 0) { ++ va_next = (va + NBPDP) & ~PDPMASK; ++ if (va_next < va) ++ va_next = eva; ++ KASSERT(va_next <= eva, ++ ("partial update of non-transparent 1G mapping " ++ "pdpe %#lx va %#lx eva %#lx va_next %#lx", ++ *pdpe, va, eva, va_next)); ++ newpdpe = (*pdpe & ~X86_PG_PKU_MASK) | ++ X86_PG_PKU(keyidx); ++ if (newpdpe != *pdpe) { ++ *pdpe = newpdpe; ++ changed = true; ++ } ++ continue; ++ } + + va_next = (va + NBPDR) & ~PDRMASK; + if (va_next < va) +@@ -11629,8 +11645,6 @@ + if (pmap->pm_type != PT_X86 || keyidx > PMAP_MAX_PKRU_IDX || + (flags & ~(AMD64_PKRU_PERSIST | AMD64_PKRU_EXCL)) != 0) + return (EINVAL); +- if (eva <= sva || eva > VM_MAXUSER_ADDRESS) +- return (EFAULT); + if ((cpu_stdext_feature2 & CPUID_STDEXT2_PKU) == 0) + return (ENOTSUP); + return (0); +--- sys/amd64/amd64/sys_machdep.c.orig ++++ sys/amd64/amd64/sys_machdep.c +@@ -30,7 +30,6 @@ + * SUCH DAMAGE. + */ + +-#include + #include "opt_capsicum.h" + #include "opt_ktrace.h" + +@@ -369,32 +368,58 @@ + break; + + case I386_SET_PKRU: +- case AMD64_SET_PKRU: ++ case AMD64_SET_PKRU: { ++ vm_offset_t addr, start, end; ++ vm_size_t len; ++ ++ addr = (uintptr_t)a64pkru.addr; ++ len = a64pkru.len; ++ + /* + * Read-lock the map to synchronize with parallel + * pmap_vmspace_copy() on fork. + */ + map = &td->td_proc->p_vmspace->vm_map; + vm_map_lock_read(map); +- error = pmap_pkru_set(PCPU_GET(curpmap), +- (vm_offset_t)a64pkru.addr, (vm_offset_t)a64pkru.addr + +- a64pkru.len, a64pkru.keyidx, a64pkru.flags); ++ if (len == 0 || !vm_map_check_boundary(map, addr, addr + len)) { ++ vm_map_unlock_read(map); ++ error = EINVAL; ++ break; ++ } ++ start = trunc_page(addr); ++ end = round_page(addr + len); ++ error = pmap_pkru_set(PCPU_GET(curpmap), start, end, ++ a64pkru.keyidx, a64pkru.flags); + vm_map_unlock_read(map); + break; ++ } + + case I386_CLEAR_PKRU: +- case AMD64_CLEAR_PKRU: ++ case AMD64_CLEAR_PKRU: { ++ vm_offset_t addr, start, end; ++ vm_size_t len; ++ + if (a64pkru.flags != 0 || a64pkru.keyidx != 0) { + error = EINVAL; + break; + } ++ ++ addr = (uintptr_t)a64pkru.addr; ++ len = a64pkru.len; ++ + map = &td->td_proc->p_vmspace->vm_map; + vm_map_lock_read(map); +- error = pmap_pkru_clear(PCPU_GET(curpmap), +- (vm_offset_t)a64pkru.addr, +- (vm_offset_t)a64pkru.addr + a64pkru.len); ++ if (len == 0 || !vm_map_check_boundary(map, addr, addr + len)) { ++ vm_map_unlock_read(map); ++ error = EINVAL; ++ break; ++ } ++ start = trunc_page(addr); ++ end = round_page(addr + len); ++ error = pmap_pkru_clear(PCPU_GET(curpmap), start, end); + vm_map_unlock_read(map); + break; ++ } + + case AMD64_DISABLE_TLSBASE: + clear_pcb_flags(pcb, PCB_TLSBASE); +--- sys/vm/vm_map.c.orig ++++ sys/vm/vm_map.c +@@ -4162,6 +4162,38 @@ + return (TRUE); + } + ++/* ++ * Check whether the specified range partially overlaps a map entry with ++ * fixed boundaries, and return false if so. ++ * ++ * The map must be locked. ++ */ ++bool ++vm_map_check_boundary(vm_map_t map, vm_offset_t start, vm_offset_t end) ++{ ++ vm_map_entry_t entry; ++ int bdry_idx; ++ ++ if (!vm_map_range_valid(map, start, end)) ++ return (false); ++ if (start == end) ++ return (true); ++ ++ if (vm_map_lookup_entry(map, start, &entry)) { ++ bdry_idx = MAP_ENTRY_SPLIT_BOUNDARY_INDEX(entry); ++ if (bdry_idx != 0 && ++ (start & (pagesizes[bdry_idx] - 1)) != 0) ++ return (false); ++ } ++ if (vm_map_lookup_entry(map, end - 1, &entry)) { ++ bdry_idx = MAP_ENTRY_SPLIT_BOUNDARY_INDEX(entry); ++ if (bdry_idx != 0 && ++ (end & (pagesizes[bdry_idx] - 1)) != 0) ++ return (false); ++ } ++ return (true); ++} ++ + /* + * + * vm_map_copy_swap_object: +--- sys/vm/vm_map.h.orig ++++ sys/vm/vm_map.h +@@ -479,6 +479,7 @@ + #endif /* ! _KERNEL */ + + #ifdef _KERNEL ++bool vm_map_check_boundary(vm_map_t, vm_offset_t, vm_offset_t); + boolean_t vm_map_check_protection (vm_map_t, vm_offset_t, vm_offset_t, vm_prot_t); + int vm_map_delete(vm_map_t, vm_offset_t, vm_offset_t); + int vm_map_find(vm_map_t, vm_object_t, vm_ooffset_t, vm_offset_t *, vm_size_t, +--- tests/sys/posixshm/posixshm_test.c.orig ++++ tests/sys/posixshm/posixshm_test.c +@@ -38,10 +38,17 @@ + #include + #include + ++#ifdef __amd64__ ++#include ++#endif ++ + #include + #include + #include ++#include ++#include + #include ++#include + #include + #include + #include +@@ -1889,6 +1896,183 @@ + } + } + ++#ifdef __amd64__ ++static sigjmp_buf jmpbuf; ++static _Atomic(void *) faultaddr; ++static _Atomic(int) faultsig; ++ ++#define KEY_RW 1 ++#define KEY_RO 2 ++#define KEY_WO 3 ++#define KEY_NO 4 ++#define VAL 0xdeadfacec0debeef ++static void ++set_keys(void) ++{ ++ int error; ++ ++ error = x86_pkru_set_perm(KEY_RW, 1, 1); ++ ATF_REQUIRE(error == 0); ++ error = x86_pkru_set_perm(KEY_RO, 1, 0); ++ ATF_REQUIRE(error == 0); ++ error = x86_pkru_set_perm(KEY_WO, 0, 1); ++ ATF_REQUIRE(error == 0); ++ error = x86_pkru_set_perm(KEY_NO, 0, 0); ++ ATF_REQUIRE(error == 0); ++} ++ ++static void ++sigsegv(int sig, siginfo_t *si, void *uc __unused) ++{ ++ faultsig = sig; ++ faultaddr = si->si_addr; ++ siglongjmp(jmpbuf, 1); ++} ++ ++static bool ++try_read(volatile uint64_t *p, uint64_t *outp) ++{ ++ if (sigsetjmp(jmpbuf, 1) == 0) { ++ *outp = *p; ++ return (true); ++ } else { ++ atomic_signal_fence(memory_order_relaxed); ++ ATF_REQUIRE(faultsig == SIGSEGV); ++ ATF_REQUIRE(faultaddr == p); ++ set_keys(); /* PKRU is not restored by siglongjmp? */ ++ return (false); ++ } ++} ++ ++static bool ++try_write(volatile uint64_t *p, uint64_t val) ++{ ++ if (sigsetjmp(jmpbuf, 1) == 0) { ++ *p = val; ++ return (true); ++ } else { ++ atomic_signal_fence(memory_order_relaxed); ++ ATF_REQUIRE(faultsig == SIGSEGV); ++ ATF_REQUIRE(faultaddr == p); ++ set_keys(); /* PKRU is not restored by siglongjmp? */ ++ return (false); ++ } ++} ++ ++ATF_TC_WITHOUT_HEAD(largepage_pkru); ++ATF_TC_BODY(largepage_pkru, tc) ++{ ++ size_t ps[MAXPAGESIZES]; ++ struct sigaction sa; ++ char *addr, *addr1; ++ int error, fd, pscnt; ++ ++ memset(&sa, 0, sizeof(sa)); ++ sa.sa_sigaction = sigsegv; ++ sa.sa_flags = SA_SIGINFO; ++ sigemptyset(&sa.sa_mask); ++ error = sigaction(SIGSEGV, &sa, NULL); ++ ATF_REQUIRE(error == 0); ++ ++ pscnt = pagesizes(ps, true); ++ ++ for (int i = 1; i < pscnt; i++) { ++ uint64_t val; ++ ++ fd = shm_open_large(i, SHM_LARGEPAGE_ALLOC_DEFAULT, ps[i]); ++ addr = mmap(NULL, ps[i], PROT_READ | PROT_WRITE, MAP_SHARED, fd, ++ 0); ++ ATF_REQUIRE_MSG(addr != MAP_FAILED, ++ "mmap(%zu bytes) failed; error=%d", ps[i], errno); ++ ++ /* ++ * Ensure that the page is faulted into the pmap. ++ */ ++ memset(addr, 0, ps[i]); ++ ++ set_keys(); ++ ++ /* ++ * Make sure we can't partially cover a largepage mapping. ++ */ ++ error = x86_pkru_protect_range(addr, PAGE_SIZE, KEY_RW, 0); ++ ATF_REQUIRE_ERRNO(EINVAL, error != 0); ++ error = x86_pkru_protect_range(addr, ps[i] - PAGE_SIZE, KEY_RW, ++ 0); ++ ATF_REQUIRE_ERRNO(EINVAL, error != 0); ++ error = x86_pkru_protect_range(addr + PAGE_SIZE, ps[i] - PAGE_SIZE, ++ KEY_RW, 0); ++ ATF_REQUIRE_ERRNO(EINVAL, error != 0); ++ error = x86_pkru_protect_range(addr + 1, ps[i], KEY_RW, 0); ++ ATF_REQUIRE_ERRNO(EINVAL, error != 0); ++ ++ /* ++ * Make sure that protections are honoured. ++ */ ++ for (int j = 1; j <= 4; j++) { ++ volatile uint64_t *addr64; ++ ++ error = x86_pkru_protect_range(addr, ps[i], 0, 0); ++ ATF_REQUIRE(error == 0); ++ ++ addr64 = (volatile uint64_t *)(void *)addr; ++ *addr64 = VAL; ++ ++ error = x86_pkru_protect_range(addr, ps[i], j, 0); ++ ATF_REQUIRE(error == 0); ++ switch (j) { ++ case KEY_RW: ++ ATF_REQUIRE(try_write(addr64, VAL)); ++ ATF_REQUIRE(try_read(addr64, &val)); ++ ATF_REQUIRE(val == VAL); ++ break; ++ case KEY_RO: ++ ATF_REQUIRE(try_read(addr64, &val)); ++ ATF_REQUIRE(val == VAL); ++ ATF_REQUIRE(!try_write(addr64, VAL)); ++ break; ++ case KEY_WO: ++ /* !access implies !modify */ ++ case KEY_NO: ++ ATF_REQUIRE(!try_read(addr64, &val)); ++ ATF_REQUIRE(!try_write(addr64, VAL)); ++ break; ++ default: ++ __unreachable(); ++ } ++ } ++ error = munmap(addr, ps[i]); ++ ATF_CHECK(error == 0); ++ ++ /* ++ * Try mapping a large page in a region partially covered by a ++ * key. ++ * ++ * Rather than detecting the mismatch when the logical mapping ++ * is created, we currently only fail once pmap_enter() is ++ * called from the fault handler. This is not ideal and might ++ * be improved in the future. ++ */ ++ error = x86_pkru_protect_range(addr, ps[i], 0, 0); ++ ATF_REQUIRE(error == 0); ++ error = x86_pkru_protect_range(addr + PAGE_SIZE, ++ ps[i] - PAGE_SIZE, KEY_RW, 0); ++ ATF_REQUIRE(error == 0); ++ ++ addr1 = mmap(addr, ps[i], PROT_READ | PROT_WRITE, ++ MAP_SHARED | MAP_FIXED, fd, 0); ++ ATF_REQUIRE(addr1 != MAP_FAILED); ++ ATF_REQUIRE(addr == addr1); ++ ATF_REQUIRE(!try_read((volatile uint64_t *)(void *)addr, &val)); ++ ATF_REQUIRE(!try_write((volatile uint64_t *)(void *)addr, VAL)); ++ } ++} ++#undef KEY_RW ++#undef KEY_RO ++#undef KEY_WO ++#undef KEY_NO ++#endif ++ + ATF_TC_WITHOUT_HEAD(largepage_reopen); + ATF_TC_BODY(largepage_reopen, tc) + { +@@ -1979,6 +2163,9 @@ + ATF_TP_ADD_TC(tp, largepage_mprotect); + ATF_TP_ADD_TC(tp, largepage_minherit); + ATF_TP_ADD_TC(tp, largepage_pipe); ++#ifdef __amd64__ ++ ATF_TP_ADD_TC(tp, largepage_pkru); ++#endif + ATF_TP_ADD_TC(tp, largepage_reopen); + + return (atf_no_error()); diff --git a/website/static/security/patches/SA-26:11/amd64-15.patch.asc b/website/static/security/patches/SA-26:11/amd64-15.patch.asc new file mode 100644 index 0000000000..65ee529c87 --- /dev/null +++ b/website/static/security/patches/SA-26:11/amd64-15.patch.asc @@ -0,0 +1,16 @@ +-----BEGIN PGP SIGNATURE----- + +iQIzBAABCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmnnoa0ACgkQbljekB8A +Gu893RAAnR7PfkWxc/HK+biRRz7RkEku19ziW39q7Z3IijNjrTUZ1VkiuCeIIzF1 +Kt6/PPmKQcMwfEAs/CXeeBS6roc85DuSQEhPAURAthJNAwkzKXZyg0C8hU7mAbln +hoPNLFebIyIfpArnhZlWg3/WF5GXtla114xFTNuDnVzdIZmWfUrNmMk73Zuk9rTD +EwfCuyYIbDByDhZ0chwTZHT5fneKDv4cr2wJmOhgEeGvfLnrCzHoNBcNOQo5ESZ1 +/zspLD66DbWIXIGU/yjxJUBsFVFW0xBjLf8Ho7vtBL7ebk91LnhVMJMzDMiZYWoj +bJDtAZOz1hRr8praCf/fPVgL79E3hJYxXHvZBlIozHs/PvGw6zCPQjPbwuGRSbQr +xMYPpCY59GcCZKbgV1+0x/xrEwyheL4EpJIfKeP6rwTGSo0jjDV4VYm5rNQrn2C+ +jmoY6M9Zn+MaBBRyNoLZeo81/A+lfoyNtD0u+81FQHBcHjtzFUDRNCiVatQ6S2N1 +eGPlGXwHYvXu6ukKKuZYPwZwlornYUP0kK5OxjLj3dyUaX6Yb0FxsiZycIQgXKmO +eTB/eZ8gAmBjePYZgSDCYLaKH67yXHjO7OxZVbA9rqtLz0Xzy6NhsE3xH8Bxy558 +FM9Nau2JSXc1UV01EVdqojX1F5svZS0C8sT4Rb+81ugSpdP05ZA= +=9SqI +-----END PGP SIGNATURE-----