Re: [cip-dev] Cip-kernel-sec Updates for Week of 2021-01-28

Hi,

On Thu, Jan 28, 2021 at 4:52 PM Pavel Machek [off-list ref] wrote:

Hi!

quoted

Also, information for CVE-2020-27066 still hasn't been disclosed, and
the affected commit is still unclear.

According to

https://nvd.nist.gov/vuln/detail/CVE-2020-27066

"In xfrm6_tunnel_free_spi of net/ipv6/xfrm6_tunnel.c, ..."

That source file is in use by 4.4 & 4.19, rt & non-rt. There are no
recent commits in that file in -next, so I believe it is not fixed in
next or mainline.

Debian maintainers speculate it might be related to 4c59406ed003
("xfrm: policy: Fix doulbe free in xfrm_policy_timer").

Of course we won't really know until Google discloses the facts.

ChenYu

Many of our configs enable it as a module:

pavel@amd:~/cip/cip-kernel-config$ grep 6_XFRM_MODE_TUN */*/*
4.19.y-cip/arm/moxa_mxc_defconfig:CONFIG_INET6_XFRM_MODE_TUNNEL=m
4.19.y-cip/arm/siemens_imx6.config:CONFIG_INET6_XFRM_MODE_TUNNEL=y
4.19.y-cip-rt/x86/siemens_i386-rt.config:CONFIG_INET6_XFRM_MODE_TUNNEL=m
4.19.y-cip/x86/plathome_obsvx2.config:CONFIG_INET6_XFRM_MODE_TUNNEL=m
4.19.y-cip/x86/plathome_obsvx2_defconfig:CONFIG_INET6_XFRM_MODE_TUNNEL=m
4.19.y-cip/x86/siemens_ipc227e_defconfig:#
CONFIG_INET6_XFRM_MODE_TUNNEL is not set
4.4.y-cip/arm/moxa_mxc_defconfig:CONFIG_INET6_XFRM_MODE_TUNNEL=m
4.4.y-cip/arm/siemens_am57xx-pxm3.config:CONFIG_INET6_XFRM_MODE_TUNNEL=m
4.4.y-cip/arm/siemens_dcu2.config:CONFIG_INET6_XFRM_MODE_TUNNEL=y
4.4.y-cip/arm/siemens_imx6_defconfig:CONFIG_INET6_XFRM_MODE_TUNNEL=y
4.4.y-cip-rt/x86/siemens_i386-rt.config:CONFIG_INET6_XFRM_MODE_TUNNEL=m
4.4.y-cip/x86/plathome_obsvx1.config:CONFIG_INET6_XFRM_MODE_TUNNEL=m
4.4.y-cip/x86/siemens_iot2000.config:CONFIG_INET6_XFRM_MODE_TUNNEL=y
5.10.y-cip/arm/moxa_mxc_defconfig:CONFIG_INET6_XFRM_MODE_TUNNEL=m
5.10.y-cip-rt/x86/siemens_i386-rt.config:CONFIG_INET6_XFRM_MODE_TUNNEL=m
5.10.y-cip/x86/plathome_obsvx2_defconfig:CONFIG_INET6_XFRM_MODE_TUNNEL=m
5.10.y-cip/x86/siemens_ipc227e_defconfig:#
CONFIG_INET6_XFRM_MODE_TUNNEL is not set