Beta Branch add cmsec ZDI-CAN-33367 skb_zerocopy kernel check in 140.00beta01

add cmsec ZDI-CAN-33367 skb_zerocopy kernel check in 140.00beta01

ZDI-CAN-33367 (CVSS 7.8, no CVE yet) is a local root bug where skb_zerocopy()
drops the SKBFL_SHARED_FRAG marker, so IPsec ESP decrypts in place over page
cache pages. It bypasses the Dirty Frag and Fragnesia fixes.

Changes:
- New tools/cmm-security/checks/check-zdi-can-33367.sh, run as
cmsec check zdi-can-33367 and in the dmotd banner when DMOTD_CVECHECK='y'
- Verdict comes from the fix entry in the running kernel's rpm changelog first:
Rocky Linux 9.8 kernel-5.14.0-687.60.1.el9_8 has the same NVR as the fixed
AlmaLinux kernel but lacks the fix
- AlmaLinux 8/9/10 and CloudLinux 7h/8 fixed NVRs are used only when the
changelog can't be read; Rocky, RHEL, Oracle Linux, Kitten and CloudLinux
9/10 rely on the changelog
- Detects the esp4/esp6 modprobe.d workaround in any file, including an
existing dirtyfrag.conf; KernelCare coverage counts only for this issue
- Stock EL6/EL7 kernels and CloudLinux 7 are reported not affected
- Same check file as 141.00beta01, verified there on AlmaLinux 8.10/9.8/10.2
and Rocky Linux 9.8/10.2

Continue reading...

140.00beta01 branch

• Branch: https://github.com/centminmod/centminmod/tree/140.00beta01
• Commit History: https://github.com/centminmod/centminmod/commits/140.00beta01

---