summaryrefslogtreecommitdiff
path: root/sysutils/xenkernel41
AgeCommit message (Collapse)AuthorFilesLines
2016-09-08Backport upstream patches for security issues:bouyer5-3/+239
XSA-185: x86: Disallow L3 recursive pagetable for 32-bit PV guests XSA-187: x86 HVM: Overflow of sh_ctxt->seg_reg[] bump PKGREVISION
2016-07-26Apply security patch from XSA-182. Bump PKGREVISIONbouyer3-3/+94
xen 4.2 is not vulnerable to XSA-183.
2016-07-09Remove python33: adapt all packages that refer to it.wiz1-2/+2
2016-03-01Newer binutils requires cmpw access to %r11 to explicitly qualify thejoerg2-1/+15
16bit part as %r11w.
2016-01-07Apply patches from Xen repository, fixing:bouyer4-3/+67
CVE-2015-8339 and CVE-2015-8340 aka XSA-159 XSA-166 CVE-2015-8550 aka XSA-155 CVE-2015-8554 aka XSA-164 Bump pkgrevision
2015-12-29Fix missing/broken rcsids.dholland3-3/+7
2015-12-05Extend PYTHON_VERSIONS_INCOMPATIBLE to 35adam1-2/+2
2015-11-04Add SHA512 digests for distfiles for sysutils categoryagc1-1/+2
Problems found with existing digests: Package memconf distfile memconf-2.16/memconf.gz b6f4b736cac388dddc5070670351cf7262aba048 [recorded] 95748686a5ad8144232f4d4abc9bf052721a196f [calculated] Problems found locating distfiles: Package dc-tools: missing distfile dc-tools/abs0-dc-burn-netbsd-1.5-0-gae55ec9 Package ipw-firmware: missing distfile ipw2100-fw-1.2.tgz Package iwi-firmware: missing distfile ipw2200-fw-2.3.tgz Package nvnet: missing distfile nvnet-netbsd-src-20050620.tgz Package syslog-ng: missing distfile syslog-ng-3.7.2.tar.gz Otherwise, existing SHA1 digests verified and found to be the same on the machine holding the existing distfiles (morden). All existing SHA1 digests retained for now as an audit trail.
2015-10-29Add patches, derived from Xen security advisory, fixing:bouyer5-3/+121
CVE-2015-7835 aka XSA-148 CVE-2015-7869 aka XSA-149 + XSA-151 CVE-2015-7971 aka XSA-152 Bump PKGREVISION
2015-09-14Avoid undefined behavior when left-shifting negative values.joerg2-1/+15
2015-04-19apply fixes from upstream forspz4-3/+255
XSA-125 Long latency MMIO mapping operations are not preemptible XSA-126 Unmediated PCI command register access in qemu
2015-03-10xsa123-4.3-4.2.patch from upstream:spz3-3/+26
x86emul: fully ignore segment override for register-only operations For ModRM encoded instructions with register operands we must not overwrite ea.mem.seg (if a - bogus in that case - segment override was present) as it aliases with ea.reg. This is CVE-2015-2151 / XSA-123.
2015-03-05Add patches for XSA-121 and XSA-122 from upstream.spz4-3/+100
2014-12-21Remove patch-CVE-2014-7188, it's already in patch-CVE-2013-4355_1bouyer2-40/+1
2014-12-11Ignore use of always non-null pointers as truth value.joerg1-2/+3
2014-11-27backport patches from Xen advisory:bouyer8-3/+483
CVE-2014-7188/XSA-108: x86/HVM: properly bound x2APIC MSR range, fixing: A buggy or malicious HVM guest can crash the host or read data relating to other guests or the hypervisor itself. CVE-2014-8594/XSA-109: x86: don't allow page table updates on non-PV page tables in do_mmu_update(), fixing: Malicious or buggy stub domain kernels or tool stacks otherwise living outside of Domain0 can mount a denial of service attack which, if successful, can affect the whole system. CVE-2014-8595/XSA-110: x86emul: enforce privilege level restrictions when loading CS, fixing: Malicious HVM guest user mode code may be able to elevate its privileges to guest supervisor mode, or to crash the guest. CVE-2014-8866/XSA-111: x86: limit checks in hypercall_xlat_continuation() to actual arguments, fixing: A buggy or malicious HVM guest can crash the host. CVE-2014-8867/XSA-112: x86/HVM: confine internally handled MMIO to solitary regions, fixing: A buggy or malicious HVM guest can crash the host. CVE-2014-9030/XSA-113: x86/mm: fix a reference counting error in MMU_MACHPHYS_UPDATE, fixing: Malicious or buggy stub domain kernels or tool stacks otherwise living outside of Domain0 can mount a denial of service attack which, if successful, can affect the whole system.
2014-10-01fix out-of-bounds memory read access in x2APIC emulation (HVM only)drochner3-6/+27
(CVE-2014-7188) bump PKGREV
2014-09-26Add patch for:bouyer5-3/+104
XSA-104 (CVE-2014-7154) - Race condition in HVMOP_track_dirty_vram XSA-105 (CVE-2014-7155) - Missing privilege level checks in x86 HLT, LGDT, LIDT, and LMSW emulation XSA-106 (CVE-2014-7156) - Missing privilege level checks in x86 emulation of software interrupts bump PKGREVISION
2014-06-18add patch from upstream to fix possible data leak (CVE-2014-4021)drochner3-3/+30
bump PKGREV
2014-05-09Mark packages that are not ready for python-3.3 also not ready for 3.4,wiz1-2/+2
until proven otherwise.
2014-05-05fix possible creation of invalid P2M entries, leading to xen crashdrochner4-12/+56
The vulnerability is only exposed to service domains for HVM guests which have privilege over the guest. In a usual configuration that means only device model emulators (qemu-dm). bump PKGREV
2014-03-28add patch from upstream (XSA-89) to fix:drochner3-10/+40
Processing of the HVMOP_set_mem_access HVM control operations does not check the size of its input and can tie up a physical CPU for extended periods of time. bump PKGREV
2014-03-06Ignore tautologic pointer checks.joerg1-2/+3
2014-02-20from upstream: fix the fix for CVE-2013-6885drochner3-12/+13
makes the workaround for AMD CPU erratum 793 work not only on 64-bit hypervisors but also for 32bit bump PKGREV (compile tested only)
2014-01-25Mark packages as not ready for python-3.x where applicable;wiz1-2/+2
either because they themselves are not ready or because a dependency isn't. This is annotated by PYTHON_VERSIONS_INCOMPATIBLE= 33 # not yet ported as of x.y.z or PYTHON_VERSIONS_INCOMPATIBLE= 33 # py-foo, py-bar respectively, please use the same style for other packages, and check during updates. Use versioned_dependencies.mk where applicable. Use REPLACE_PYTHON instead of handcoded alternatives, where applicable. Reorder Makefile sections into standard order, where applicable. Remove PYTHON_VERSIONS_INCLUDE_3X lines since that will be default with the next commit. Whitespace cleanups and other nits corrected, where necessary.
2014-01-24add patch from upstream to add missing privilege checkdrochner3-3/+21
from the advisory: Malicious or misbehaving unprivileged guests can cause the host or other guests to malfunction. This can result in host-wide denial of service. Privilege escalation, while seeming to be unlikely, cannot be excluded. Only PV guests can take advantage of this vulnerability. (CVE-2014-1666) bump PKGREV
2013-12-04add patch from upstream to fixdrochner4-3/+44
"Guest triggerable AMD CPU erratum may cause host hang" bump PKGREV
2013-11-29add patches from upstream to fix two security problems:drochner4-6/+52
-another lock inversion -privilege escalation (not exploitable in standard setups) bump PKGREV
2013-11-23add patch from upstream to fix lock order inversion possibly leadingdrochner3-3/+84
to deadlock (CVE-2013-4494) bump PKGREV
2013-10-22add patch from upstream to fix information leak through outs instructiondrochner3-3/+25
emulation (CVE-2013-4368) bump PKGREV
2013-10-01add patches from upstream to fix security problems:drochner8-2/+225
-Information leak on AVX and/or LWP capable CPUs (CVE-2013-1442 / XSA-62) -Information leaks through I/O instruction emulation (CVE-2013-4355 / XSA-63) -Information leak through fbld instruction emulation (CVE-2013-4361 / XSA-66) bump PKGREV
2013-09-27Make -Wunused-function non-fatal for clang.joerg1-2/+3
2013-09-11update to 4.1.6.1drochner18-1206/+11
This release fixes the following critical vulnerabilities: CVE-2013-1918 / XSA-45: Several long latency operations are not preemptible CVE-2013-1952 / XSA-49: VT-d interrupt remapping source validation flaw for bridges CVE-2013-2076 / XSA-52: Information leak on XSAVE/XRSTOR capable AMD CPUs CVE-2013-2077 / XSA-53: Hypervisor crash due to missing exception recovery on XRSTOR CVE-2013-2078 / XSA-54: Hypervisor crash due to missing exception recovery on XSETBV CVE-2013-2194, CVE-2013-2195, CVE-2013-2196 / XSA-55: Multiple vulnerabilities in libelf PV kernel handling CVE-2013-2072 / XSA-56: Buffer overflow in xencontrol Python bindings affecting xend CVE-2013-2211 / XSA-57: libxl allows guest write access to sensitive console related xenstore keys CVE-2013-1432 / XSA-58: Page reference counting error due to XSA-45/CVE-2013-1918 fixes XSA-61: libxl partially sets up HVM passthrough even with disabled iommu This release contains many bug fixes and improvements. The highlights are: addressing a regression from the fix for XSA-21 addressing a regression from the fix for XSA-46 bug fixes to low level system state handling, including certain hardware errata workarounds (CVE-2013-1918 and CVE-2013-1952 were patched in pkgsrc before)
2013-07-13Fix header guard.joerg2-1/+12
2013-06-19Explain xen version differences.gdt2-9/+13
There are 5 versions of xen in pkgsrc, which is confusing. Explain in DESCR which version is in which package (xenkernel3 contains 3.1), and which versions support PCI passthrough (only 3.1). Explain which versions support non-PAE (3.1) and PAE (3.3, 4.1, 4.2), because the HOWTO is out of date and it's easy to end up with a non-working system on a 3.1 to 3.3 update. Cuation that 2.0 is beyond crufty. This is a DESCR-only change (with PKGREVISION++ of course). (ok during freeze agc@)
2013-05-10Partially back out change to PYTHON_FOR_BUILD_ONLY.riastradh1-2/+2
This broke packages that needed a target Python at build-time. Instead, change it from defined/undefined to yes/no/tool. Most cases of defined used `yes' anyway; fix the few stragglers do that instead. New case `tool' is for TOOL_DEPENDS rather than buildlink3.
2013-05-03update to 4.1.5drochner24-296/+1178
This integrates fixes for all vulnerabilities which were patched in pkgsrc before. Among many bug fixes and improvements (around 50 since Xen 4.1.4): * ACPI APEI/ERST finally working on production systems * Bug fixes for other low level system state handling * Support for xz compressed Dom0 and DomU kernels
2013-04-19Add patches from Xen security advisory:bouyer8-3/+259
http://lists.xen.org/archives/html/xen-announce/2013-04/msg00000.html http://lists.xen.org/archives/html/xen-announce/2013-04/msg00005.html http://lists.xen.org/archives/html/xen-announce/2013-04/msg00006.html bump PKGREVISION
2013-04-11Allow building Xen infrastructure with Clang. Fix various bugs injoerg7-2/+120
xenkernel3, xenkernel41, xentools3 and xentools41 exposed by Clang default warnings. Bump revisions for those.
2013-04-07Edited DESCR in the case of:rodent1-8/+7
File too long (should be no more than 24 lines). Line too long (should be no more than 80 characters). Trailing empty lines. Trailing white-space. Trucated the long files as best as possible while preserving the most info contained in them.
2013-04-06'EXTRACT_SUFX is ".tar.gz" by default, so this definition may berodent1-2/+1
redundant.' - It was. Removed.
2013-01-20oops, a patch was in the wrong sub-pkgdrochner2-36/+1
bump PKGREV
2013-01-17update to 4.1.4drochner17-551/+70
changes: -fixes for many vulnerabilities (were mostly patched in pkgsrc) -bug fixes and improvements (almost 100 since Xen 4.1.3). Highlights are: -A fix for a long standing time management issue -Bug fixes for S3 (suspend to RAM) handling -Bug fixes for other low level system state handling pkgsrc note: fixes for CVE-2012-5634 (interrupt issue on IOMMU systems) and CVE-2012-6075 (oversized packets from e1000 driver) are already included
2012-12-05add another batch of security patches from upstreamdrochner9-8/+371
bump PKGREV
2012-11-14add patches from Xen SA 20..24 to fix various security problemsdrochner8-8/+113
(CVE-2012-4535..4539) bump PKGREV
2012-10-23Drop superfluous PKG_DESTDIR_SUPPORT, "user-destdir" is default these days.asau1-3/+1
2012-09-16Fix COMMENT, noted by Mayuresh on pkgsrc-users.dholland1-2/+2
2012-09-12update to 4.1.3drochner9-213/+87
also add security patches from upstream (for CVE-2012-3497, no patches are available yet) changes: -fixes for vulnerabilities were integrated -many bug fixes and improvements, Highlights are: -Updates for the latest Intel/AMD CPU revisions -Bug fixes for IOMMU handling (device passthrough to HVM guests) approved by maintainer
2012-08-10add patch from upstream to fix a possible DOS by HVM guests on teardowndrochner3-3/+19
(CVE-2012-3433) bump PKGREV
2012-08-01Slightly simplify build process.asau1-5/+5
generated by cgit v1.2.3 (git 2.39.1) at 2025-02-21 07:45:42 +0000