From e8007c0e8911fbcd99268b0b30d3e9f069f22c20 Mon Sep 17 00:00:00 2001 From: Joachim Fasting Date: Fri, 17 Feb 2017 19:09:50 +0100 Subject: [PATCH] linux_4_9: patch for CVE-2017-5986 Seems fairly low impact[1] but we might as well patch it until a new 4.9 version is released [1]: https://bugzilla.redhat.com/show_bug.cgi?id=1420276 --- pkgs/os-specific/linux/kernel/patches.nix | 9 +++++++++ pkgs/top-level/all-packages.nix | 1 + 2 files changed, 10 insertions(+) diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix index 33f11ad5ae3e..9bc47dd624d8 100644 --- a/pkgs/os-specific/linux/kernel/patches.nix +++ b/pkgs/os-specific/linux/kernel/patches.nix @@ -175,4 +175,13 @@ rec { }; }; + sctp_bug_on_CVE_2017_5986 = rec + { name = "sctp_BUG_ON_CVE_2017_5986.patch"; + patch = fetchpatch { + inherit name; + url = "https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/patch/?id=2dcab598484185dea7ec22219c76dcdd59e3cb90"; + sha256 = "15np10bfm5yzby9zbkrh23qpm91wnprblsk0xn9yjryypnz8njxh"; + }; + }; + } diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 47bd30652f38..1b178665b816 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -11294,6 +11294,7 @@ with pkgs; # !!! 4.7 patch doesn't apply, 4.9 patch not up yet, will keep checking # kernelPatches.cpu-cgroup-v2."4.7" kernelPatches.modinst_arg_list_too_long + kernelPatches.sctp_bug_on_CVE_2017_5986 ] ++ lib.optionals ((platform.kernelArch or null) == "mips") [ kernelPatches.mips_fpureg_emu