linux: Add patch to fix CVE-2016-5829 (#16824)

Fixed for all available 4.x series kernels.

From CVE-2016-5829:

Multiple heap-based buffer overflows in the hiddev_ioctl_usage function
in drivers/hid/usbhid/hiddev.c in the Linux kernel through 4.6.3 allow
local users to cause a denial of service or possibly have unspecified
other impact via a crafted (1) HIDIOCGUSAGES or (2) HIDIOCSUSAGES ioctl
call.

Changed files
+28 -5
pkgs
os-specific
linux
kernel
top-level
+9 -1
pkgs/os-specific/linux/kernel/patches.nix
···
-
{ stdenv, fetchurl, pkgs }:
+
{ stdenv, fetchurl, fetchpatch, pkgs }:
let
···
qat_common_Makefile =
{ name = "qat_common_Makefile";
patch = ./qat_common_Makefile.patch;
+
};
+
+
hiddev_CVE_2016_5829 =
+
{ name = "hiddev_CVE_2016_5829";
+
patch = fetchpatch {
+
url = "https://sources.debian.net/data/main/l/linux/4.6.3-1/debian/patches/bugfix/all/HID-hiddev-validate-num_values-for-HIDIOCGUSAGES-HID.patch";
+
sha256 = "14rm1qr87p7a5prz8g5fwbpxzdp3ighj095x8rvhm8csm20wspyy";
+
};
};
}
+19 -4
pkgs/top-level/all-packages.nix
···
linux_4_1 = callPackage ../os-specific/linux/kernel/linux-4.1.nix {
-
kernelPatches = [ kernelPatches.bridge_stp_helper ]
+
kernelPatches =
+
[ kernelPatches.bridge_stp_helper
+
kernelPatches.hiddev_CVE_2016_5829
+
]
++ lib.optionals ((platform.kernelArch or null) == "mips")
[ kernelPatches.mips_fpureg_emu
kernelPatches.mips_fpu_sigill
···
linux_4_4 = callPackage ../os-specific/linux/kernel/linux-4.4.nix {
-
kernelPatches = [ kernelPatches.bridge_stp_helper kernelPatches.qat_common_Makefile ]
+
kernelPatches =
+
[ kernelPatches.bridge_stp_helper
+
kernelPatches.qat_common_Makefile
+
kernelPatches.hiddev_CVE_2016_5829
+
]
++ lib.optionals ((platform.kernelArch or null) == "mips")
[ kernelPatches.mips_fpureg_emu
kernelPatches.mips_fpu_sigill
···
linux_4_5 = callPackage ../os-specific/linux/kernel/linux-4.5.nix {
-
kernelPatches = [ kernelPatches.bridge_stp_helper kernelPatches.qat_common_Makefile ]
+
kernelPatches =
+
[ kernelPatches.bridge_stp_helper
+
kernelPatches.qat_common_Makefile
+
kernelPatches.hiddev_CVE_2016_5829
+
]
++ lib.optionals ((platform.kernelArch or null) == "mips")
[ kernelPatches.mips_fpureg_emu
kernelPatches.mips_fpu_sigill
···
linux_4_6 = callPackage ../os-specific/linux/kernel/linux-4.6.nix {
-
kernelPatches = [ kernelPatches.bridge_stp_helper kernelPatches.qat_common_Makefile ]
+
kernelPatches =
+
[ kernelPatches.bridge_stp_helper
+
kernelPatches.qat_common_Makefile
+
kernelPatches.hiddev_CVE_2016_5829
+
]
++ lib.optionals ((platform.kernelArch or null) == "mips")
[ kernelPatches.mips_fpureg_emu
kernelPatches.mips_fpu_sigill