FreeBSD Security Advisory FreeBSD-SA-24:01.bhyveload

[George Mitchell]

For a complicated reason, I avoid "freebsd-update" and update the
kernel and the world from source.

Given that perhaps I am an idiot, nevertheless I addressed this
particular security advisory by updating my /usr/src tree, and
(having observed what files were updated) running:

cd /usr/src/lib/libutil
make
make install
cd /usr/src/usr.sbin/bhyveload
make
make install
cp -p /usr/src/usr.sbin/periodic/etc/daily/480.leapfile-ntpd \
/etc/periodic/daily/480.leapfile-ntpd

So I think I have the appropriate stuff installed now, though of
course freebsd-version -u still reports 13.2-RELEASE-p9 instead of
-p10, and the daily security run says:

FreeBSD-13.2_9 is vulnerable:
FreeBSD -- bhyveload(8) host file access
CVE: CVE-2024-25940
WWW:
https://vuxml.FreeBSD.org/freebsd/c62285cb-cb46-11ee-b609-002590c1f29c.html

Is there a hack that lets me fool freebsd-version into reporting -p10
instead of -p9? -- George

P.S. Feel free to scold me for stupidly trying to do things the wrong
way.

[George Mitchell]

Post by George Mitchell
For a complicated reason, I avoid "freebsd-update" and update the
kernel and the world from source.
[... discussion proving I am an idiot ...]
Is there a hack that lets me fool freebsd-version into reporting -p10
instead of -p9?                                            -- George
[...]

The hack (and it's ridiculously ugly) is to edit /bin/freebsd-version
and change:
USERLAND_VERSION="13.2-RELEASE-p9"
to:
USERLAND_VERSION="13.2-RELEASE-p10"

Sorry for inflicting this on all of you ... -- George

[George Mitchell]

[I promise this is the last time I will write about this!]

Post by George Mitchell

Post by George Mitchell
For a complicated reason, I avoid "freebsd-update" and update the
kernel and the world from source.
[... discussion proving I am an idiot ...]
Is there a hack that lets me fool freebsd-version into reporting -p10
instead of -p9?                                            -- George
[...]

The hack (and it's ridiculously ugly) is to edit /bin/freebsd-version
USERLAND_VERSION="13.2-RELEASE-p9"
USERLAND_VERSION="13.2-RELEASE-p10"
Sorry for inflicting this on all of you ...              -- George

The less distressing way to do this, even though it's still a hack, is:

cd /usr/src/bin/freebsd-version
make
make install

It synthesizes USERLAND_VERSION from REVISION and BRANCH in newvers.sh,
which I had properly updated with my "gitup release".

We now return you to our regularly-scheduled programming. -- George