[FIPS 8 Compliant] Many CVES

[PlaidCat]

Commits

    use uniform permission checks for all mount propagation changes

    jira VULN-98606
    jira VULN-98607
    cve-bf CVE-2025-38498
    commit-author Al Viro <viro@zeniv.linux.org.uk>
    commit cffd0441872e7f6b1fce5e78fb1c99187a291330
    upstream-diff This is a partial backport due to missing 9ffb14ef61ba
            which introduces do_set_group(). This is where the below
            operation on diffferent aspects of the same thing is introduced.
            This change does however introduce some additional safety checks
            which should be considered.

    net: fix udp gso skb_segment after pull from frag_list

    jira VULN-156444
    jira VULN-156445
    cve CVE-2025-38124
    commit-author Shiming Cheng <shiming.cheng@mediatek.com>
    commit 3382a1ed7f778db841063f5d7e317ac55f9e7f72

    bpf: Fix a segment issue when downgrading gso_size

    jira VULN-38750
    jira VULN-38751
    cve CVE-2024-42281
    commit-author Fred Li <dracodingfly@gmail.com>
    commit fa5ef655615a01533035c6139248c5b33aa27028

    do_change_type(): refuse to operate on unmounted/not ours mounts

    jira VULN-98607
    jira VULN-98606
    cve CVE-2025-38498
    commit-author Al Viro <viro@zeniv.linux.org.uk>
    commit 12f147ddd6de7382dad54812e65f3f08d05809fc

    vsock: Fix transport_* TOCTOU

    jira VULN-80682
    jira VULN-80681
    cve CVE-2025-38461
    commit-author Michal Luczaj <mhal@rbox.co>
    commit 687aa0c5581b8d4aa87fd92973e4ee576b550cdf

    gso: fix udp gso fraglist segmentation after pull from frag_list

    jira VULN-45766
    jira VULN-45767
    cve cve-2024-49978
    commit-author Willem de Bruijn <willemb@google.com>
    commit a1e40ac5b5e9077fe1f7ae0eb88034db0f9ae1ab
    upstream-diff contextual diff is off due to massive reworks.
            In addition __udpv6_gso_segment_list_csum definition is not
            included.  This was included via "net/gro.h" via 75082e7f4680
            which is a bug fix to 4721031c3559 "net: move gro definitions to
            include/net/gro.h". Since we also do not have that we're just
            directly including net/ip6_checksum.h to this file.

Build

[jmaple@devbox code]$ egrep -B 5 -A 5 "\[TIMER\]|^Starting Build" $(ls -t kbuild* | head -n1)
/mnt/code/kernel-src-tree-build
Running make mrproper...
  CLEAN   cscope.in.out cscope.po.out cscope.out cscope.files
[TIMER]{MRPROPER}: 4s
x86_64 architecture detected, copying config
'configs/kernel-x86_64.config' -> '.config'
Setting Local Version for build
CONFIG_LOCALVERSION="-jmaple_udp_gso_fraglist-106adb1d0a8f"
Making olddefconfig
--
  HOSTLD  scripts/kconfig/conf
scripts/kconfig/conf  --olddefconfig Kconfig
#
# configuration written to .config
#
Starting Build
scripts/kconfig/conf  --syncconfig Kconfig
  SYSTBL  arch/x86/include/generated/asm/syscalls_32.h
  SYSHDR  arch/x86/include/generated/asm/unistd_32_ia32.h
  SYSHDR  arch/x86/include/generated/asm/unistd_64_x32.h
  SYSTBL  arch/x86/include/generated/asm/syscalls_64.h
--
  LD [M]  sound/usb/usx2y/snd-usb-usx2y.ko
  LD [M]  sound/virtio/virtio_snd.ko
  LD [M]  sound/x86/snd-hdmi-lpe-audio.ko
  LD [M]  sound/xen/snd_xen_front.ko
  LD [M]  virt/lib/irqbypass.ko
[TIMER]{BUILD}: 1894s
Making Modules
  INSTALL arch/x86/crypto/blowfish-x86_64.ko
  INSTALL arch/x86/crypto/camellia-aesni-avx-x86_64.ko
  INSTALL arch/x86/crypto/camellia-aesni-avx2.ko
  INSTALL arch/x86/crypto/camellia-x86_64.ko
--
  INSTALL sound/virtio/virtio_snd.ko
  INSTALL sound/x86/snd-hdmi-lpe-audio.ko
  INSTALL sound/xen/snd_xen_front.ko
  INSTALL virt/lib/irqbypass.ko
  DEPMOD  4.18.0-jmaple_udp_gso_fraglist-106adb1d0a8f+
[TIMER]{MODULES}: 17s
Making Install
sh ./arch/x86/boot/install.sh 4.18.0-jmaple_udp_gso_fraglist-106adb1d0a8f+ arch/x86/boot/bzImage \
        System.map "/boot"
[TIMER]{INSTALL}: 18s
Checking kABI
kABI check passed
Setting Default Kernel to /boot/vmlinuz-4.18.0-jmaple_udp_gso_fraglist-8f2f35383ed4+ and Index to 2
Hopefully Grub2.0 took everything ... rebooting after time metrices
[TIMER]{MRPROPER}: 4s
[TIMER]{BUILD}: 1894s
[TIMER]{MODULES}: 17s
[TIMER]{INSTALL}: 18s
[TIMER]{TOTAL} 1938s
Rebooting in 10 seconds

KeslfTests

[jmaple@devbox code]$ ./get_kselftest_diff.sh
kselftest.4.18.0-jmaple_batch_12_fips-8-compliant_4.18.0-553.16.1-0bc2+.log
204
kselftest.4.18.0-jmaple_batch_12_fips-8-compliant_4.18.0-553.16.1-d70e+.log
204
kselftest.4.18.0-jmaple_batch_12_fips-8-compliant_4.18.0-553.16.1-9a06+.log
204
kselftest.4.18.0-jmaple_udp_gso_fraglist-106adb1d0a8f+.log
204
Before: kselftest.4.18.0-jmaple_batch_12_fips-8-compliant_4.18.0-553.16.1-9a06+.log
After: kselftest.4.18.0-jmaple_udp_gso_fraglist-106adb1d0a8f+.log
Diff:
No differences found.

get_kselftest_diff.sh experimental script

#!/bin/bash

FILES=$(ls -rt kselftest.* | tail -n4)

while read -r line; do
        echo $line; grep '^ok ' $line | wc -l ;
done <<< "$FILES"

BEFORE=""
AFTER+=""

while read -r line; do
    BEFORE=${AFTER}
    AFTER=${line}
done <<< "$FILES"

echo "Before: $BEFORE"
echo "After: $AFTER"
echo "Diff:"
DIFF=$(grep ok <(diff -adU0 <(grep ^ok "${BEFORE}" | sort -h) <(grep ^ok "${AFTER}" | sort -h)))
if [ -z "$DIFF" ]; then
    echo "No differences found."
else
    echo "$DIFF"
fi

[github-actions]

🔍 Upstream Linux Kernel Commit Check

• ⚠️ PR commit 51deadb613fb (gso: fix udp gso fraglist segmentation after pull from frag_list) references upstream commit
  a1e40ac5b5e9 which has been referenced by a Fixes: tag in the upstream
  Linux kernel:

    3382a1ed7f77 net: fix udp gso skb_segment after pull from frag_list (Shiming Cheng)

• ⚠️ PR commit 07a50aedff30 (do_change_type(): refuse to operate on unmounted/not ours mounts) references upstream commit
  12f147ddd6de which has been referenced by a Fixes: tag in the upstream
  Linux kernel:

    cffd0441872e use uniform permission checks for all mount propagation changes (Al Viro)

This is an automated message from the kernel commit checker workflow.

[PlaidCat]

🔍 Upstream Linux Kernel Commit Check

* ⚠️ PR commit `51deadb613fb (gso: fix udp gso fraglist segmentation after pull from frag_list)` references upstream commit
  `a1e40ac5b5e9` which has been referenced by a `Fixes:` tag in the upstream
  Linux kernel:

    3382a1ed7f77 net: fix udp gso skb_segment after pull from frag_list (Shiming Cheng)

* ⚠️ PR commit `07a50aedff30 (do_change_type(): refuse to operate on unmounted/not ours mounts)` references upstream commit
  `12f147ddd6de` which has been referenced by a `Fixes:` tag in the upstream
  Linux kernel:

    cffd0441872e use uniform permission checks for all mount propagation changes (Al Viro)

This is an automated message from the kernel commit checker workflow.

These are already present.

[bmastbergen]

🥌