UBUNTU: [Config] UNMAP_KERNEL_AT_EL0=y && HARDEN_BRANCH_PREDICTOR=y

CVE-2017-5753
CVE-2017-5715
CVE-2017-5754

Acked-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>

diff --git a/debian.raspi2/config/arm64/config.common.arm64 b/debian.raspi2/config/arm64/config.common.arm64
index b9b73dca3e7d75515ff83ceba2d4d226f1bc3e99..99d59a8fffb6b81bf13e47eef321fbdf2640a515 100644 (file)
--- a/debian.raspi2/config/arm64/config.common.arm64
+++ b/debian.raspi2/config/arm64/config.common.arm64
@@ -11,6 +11,7 @@ CONFIG_ARCH_SELECT_MEMORY_MODEL=y
 CONFIG_ARCH_SPARSEMEM_DEFAULT=y
 CONFIG_AUDIT_ARCH_COMPAT_GENERIC=y
 # CONFIG_BCM_VC_SM is not set
+CONFIG_HAVE_ARCH_VMAP_STACK=y
 # CONFIG_IRQ_POLL is not set
 CONFIG_LIBIO=y
 CONFIG_MAGIC_SYSRQ_DEFAULT_ENABLE=0x1

diff --git a/debian.raspi2/config/armhf/config.common.armhf b/debian.raspi2/config/armhf/config.common.armhf
index c4d9692784c9c69470db1c8f55fa760916062ff8..5db52349e9b594291de22a4bfda129f4f8e6a0d4 100644 (file)
--- a/debian.raspi2/config/armhf/config.common.armhf
+++ b/debian.raspi2/config/armhf/config.common.armhf
@@ -11,6 +11,7 @@ CONFIG_ARCH_OPTIONAL_KERNEL_RWX_DEFAULT=y
 # CONFIG_ARCH_SPARSEMEM_DEFAULT is not set
 # CONFIG_AUDIT_ARCH_COMPAT_GENERIC is not set
 CONFIG_BCM_VC_SM=y
+# CONFIG_HAVE_ARCH_VMAP_STACK is not set
 CONFIG_IRQ_POLL=y
 # CONFIG_LIBIO is not set
 CONFIG_MAGIC_SYSRQ_DEFAULT_ENABLE=0x01b6

diff --git a/debian.raspi2/config/config.common.ubuntu b/debian.raspi2/config/config.common.ubuntu
index 26f09a460b3b18caa5440d3bdabf96a38a994034..7b77a43d3ed50fb81537bf8bd09a313d9a4ad52e 100644 (file)
--- a/debian.raspi2/config/config.common.ubuntu
+++ b/debian.raspi2/config/config.common.ubuntu
@@ -303,6 +303,7 @@ CONFIG_ARM64_MODULE_CMODEL_LARGE=y
 CONFIG_ARM64_MODULE_PLTS=y
 CONFIG_ARM64_PAGE_SHIFT=12
 CONFIG_ARM64_PAN=y
+# CONFIG_ARM64_PMEM is not set
 CONFIG_ARM64_PTDUMP_CORE=y
 # CONFIG_ARM64_PTDUMP_DEBUGFS is not set
 # CONFIG_ARM64_RANDOMIZE_TEXT_OFFSET is not set
@@ -2044,6 +2045,7 @@ CONFIG_HAMRADIO=y
 CONFIG_HANDLE_DOMAIN_IRQ=y
 CONFIG_HARDENED_USERCOPY=y
 # CONFIG_HARDENED_USERCOPY_PAGESPAN is not set
+CONFIG_HARDEN_BRANCH_PREDICTOR=y
 CONFIG_HARDIRQS_SW_RESEND=y
 CONFIG_HAS_DMA=y
 CONFIG_HAS_IOMEM=y
@@ -2064,7 +2066,6 @@ CONFIG_HAVE_ARCH_PFN_VALID=y
 CONFIG_HAVE_ARCH_SECCOMP_FILTER=y
 CONFIG_HAVE_ARCH_TRACEHOOK=y
 CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE=y
-# CONFIG_HAVE_ARCH_VMAP_STACK is not set
 CONFIG_HAVE_ARM_ARCH_TIMER=y
 CONFIG_HAVE_ARM_SMCCC=y
 # CONFIG_HAVE_BOOTMEM_INFO_NODE is not set
@@ -5927,6 +5928,7 @@ CONFIG_UNIX=y
 CONFIG_UNIX98_PTYS=y
 CONFIG_UNIXWARE_DISKLABEL=y
 CONFIG_UNIX_DIAG=m
+CONFIG_UNMAP_KERNEL_AT_EL0=y
 CONFIG_UNUSED_SYMBOLS=y
 CONFIG_UPROBES=y
 CONFIG_UPROBE_EVENTS=y
@@ -6367,6 +6369,7 @@ CONFIG_VL6180=m
 CONFIG_VLAN_8021Q=m
 CONFIG_VLAN_8021Q_GVRP=y
 CONFIG_VLAN_8021Q_MVRP=y
+CONFIG_VMAP_STACK=y
 # CONFIG_VMSPLIT_1G is not set
 CONFIG_VMSPLIT_2G=y
 # CONFIG_VMSPLIT_3G is not set