Git-Mirrors/DivestOS
1
0
Fork 0
mirror of https://github.com/Divested-Mobile/DivestOS-Build.git synced 2024-12-14 18:34:30 -05:00
Code Issues Packages Projects Releases Wiki Activity
2ce69753b4
DivestOS/Scripts/Common/Fix_CVE_Patchers.sh

167 lines
17 KiB
Bash
Raw Normal View History

Update CVE patchers
2020-04-06 16:36:46 -04:00
#!/bin/bash
2024 Signed-off-by: Tavi <tavi@divested.dev>
2024-04-22 07:48:54 -04:00
#DivestOS: A mobile operating system divested from the norm.
#Copyright (c) 2020-2024 Divested Computing Group
Update CVE patchers
2020-04-06 16:36:46 -04:00
#
#This program is free software: you can redistribute it and/or modify
Going the distance... [pt3] Signed-off-by: Tavi <tavi@divested.dev>
2024-07-27 18:00:56 -04:00
#it under the terms of the GNU Affero General Public License as published by
Update CVE patchers
2020-04-06 16:36:46 -04:00
#the Free Software Foundation, either version 3 of the License, or
#(at your option) any later version.
#
#This program is distributed in the hope that it will be useful,
#but WITHOUT ANY WARRANTY; without even the implied warranty of
#MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
Going the distance... [pt3] Signed-off-by: Tavi <tavi@divested.dev>
2024-07-27 18:00:56 -04:00
#GNU Affero General Public License for more details.
Update CVE patchers
2020-04-06 16:36:46 -04:00
#
Going the distance... [pt3] Signed-off-by: Tavi <tavi@divested.dev>
2024-07-27 18:00:56 -04:00
#You should have received a copy of the GNU Affero General Public License
Fixup Signed-off-by: Tavi <tavi@divested.dev>
2024-07-27 18:31:21 -04:00
#along with this program. If not, see <https://www.gnu.org/licenses/>.
More fixes Ensure new shells have the correct settings too. Signed-off-by: Tad <tad@spotco.us>
2021-10-16 19:15:19 -04:00
umask 0022;
Hard fail on error Signed-off-by: Tad <tad@spotco.us>
2021-10-16 15:28:15 -04:00
set -euo pipefail;
Update CVE patchers
2020-04-06 16:36:46 -04:00
commentPatches() {
file="$1";
Small changes Signed-off-by: Tad <tad@spotco.us>
2021-10-14 14:01:10 -04:00
if [ -f "$file" ]; then
Update CVE patchers
2020-04-06 16:36:46 -04:00
shift;
for var in "$@"
do
#escaped=$(printf "%q" "$var");
#echo $escaped;
Small changes Signed-off-by: Tad <tad@spotco.us>
2021-10-14 14:01:10 -04:00
sed -i "$file" -e '\|'$var'| s|^#*|#|';
Update CVE patchers
2020-04-06 16:36:46 -04:00
done
fi;
}
14.1: add athene tried to buy a harpia, ended up with an athene :( Signed-off-by: Tad <tad@spotco.us>
2023-08-29 19:46:57 -04:00
#XXX: Patches that will compile but...
#break boot completely
Small tweaks Signed-off-by: Tad <tad@spotco.us>
2021-12-31 21:14:13 -05:00
# 0006-AndroidHardening-Kernel_Hardening/3.18/0026.patch
# 0006-AndroidHardening-Kernel_Hardening/3.10/0009.patch
# CVE-2017-13218/4.4/0025.patch
14.1: add athene tried to buy a harpia, ended up with an athene :( Signed-off-by: Tad <tad@spotco.us>
2023-08-29 19:46:57 -04:00
#crash when unplugging headphones while using FM radio
# CVE-2021-Misc2/3.4/0049.patch
Small tweaks Signed-off-by: Tad <tad@spotco.us>
2021-12-31 21:14:13 -05:00
Compile fixes Signed-off-by: Tad <tad@spotco.us>
2022-08-28 16:20:29 -04:00
commentPatches android_kernel_amazon_hdx-common.sh "CVE-2021-Misc2/3.4/0055.patch" "CVE-2021-Misc2/3.4/0056.patch";
Unbreak last commit This should be most of it also - properly update webview, repopick doesn't seem to handle the branch - always cd back to base, to prevent script breakage
2021-01-24 00:44:34 -05:00
commentPatches android_kernel_asus_fugu.sh "CVE-2014-2568" "CVE-2014-8559" "CVE-2015-8746" "CVE-2017-5551" "LVT-2017-0003/3.10/0001.patch";
Fixups + Churn Signed-off-by: Tavi <tavi@divested.dev>
2024-08-11 01:07:03 -04:00
commentPatches android_kernel_asus_grouper.sh "CVE-2017-15868" "CVE-2021-Misc2/3.4/0055.patch" "CVE-2021-Misc2/3.4/0056.patch" "CVE-2024-40904";
Update CVE patchers
2020-04-06 16:36:46 -04:00
commentPatches android_kernel_asus_msm8916.sh "CVE-2018-13913/ANY/0001.patch";
commentPatches android_kernel_asus_msm8953.sh "CVE-2017-13162/3.18/0001.patch";
Fix errors from compile test of all 14.1 kernels
2020-10-14 09:50:10 -04:00
commentPatches android_kernel_cyanogen_msm8916.sh "CVE-2018-13913/ANY/0001.patch" "CVE-2018-5897" "CVE-2018-9514" "CVE-2018-11266";
Compile fixes Signed-off-by: Tad <tad@spotco.us>
2022-08-28 16:20:29 -04:00
commentPatches android_kernel_cyanogen_msm8974.sh "CVE-2017-7373";
GrapheneOS kernel hardening patches update Maybe some compile breakage Signed-off-by: Tad <tad@spotco.us>
2023-01-24 18:20:37 -05:00
commentPatches android_kernel_essential_msm8998.sh "0008-Graphene-Kernel_Hardening-canaries/4.4/0002.patch" "CVE-2017-13218" "CVE-2019-14047/ANY/0002.patch";
Fix errors from compile test of all 14.1 kernels
2020-10-14 09:50:10 -04:00
commentPatches android_kernel_fairphone_msm8974.sh "CVE-2018-20169";
Small fixup Signed-off-by: Tad <tad@spotco.us>
2021-11-06 19:12:28 -04:00
commentPatches android_kernel_fairphone_sdm632.sh "CVE-2019-19319" "CVE-2020-1749" "CVE-2020-8992" "CVE-2021-3347" "CVE-2021-20322";
19.1: add FP4 Signed-off-by: Tad <tad@spotco.us>
2022-08-03 11:29:36 -04:00
commentPatches android_kernel_fairphone_sm7225.sh "CVE-2018-5873" "CVE-2021-3444" "CVE-2022-1184/^5.18/0001.patch" "CVE-2021-3600";
GrapheneOS kernel hardening patches update Maybe some compile breakage Signed-off-by: Tad <tad@spotco.us>
2023-01-24 18:20:37 -05:00
commentPatches android_kernel_fxtec_msm8998.sh "0008-Graphene-Kernel_Hardening-slab" "0008-Graphene-Kernel_Hardening-canaries/4.4/0002.patch" "CVE-2019-11599" "CVE-2019-16746" "CVE-2019-18282" "CVE-2019-19319" "CVE-2019-ctnl-addr-leak" "CVE-2020-0429" "CVE-2020-1749" "CVE-2020-8992" "CVE-2020-16166";
Promotions 16.0 santoni/land to 20.0 Mi8937 unified 17.1 griffin to 18.1 17.1 star*/crownlte to 20.0 20.0 add pro1x Signed-off-by: Tad <tad@spotco.us>
2023-04-17 13:06:09 -04:00
commentPatches android_kernel_fxtec_sm6115.sh "CVE-2018-5873" "CVE-2021-3444" "CVE-2021-3600";
Update CVE patchers Untested. I expect some breakage.
2020-08-08 12:03:23 -04:00
commentPatches android_kernel_google_bonito.sh "CVE-2020-0067";
18.1: small fixes Signed-off-by: Tad <tad@spotco.us>
2022-02-12 07:32:29 -05:00
commentPatches android_kernel_google_coral.sh "CVE-2019-19319" "CVE-2020-1749" "CVE-2020-8992" "CVE-2021-30324";
GrapheneOS kernel hardening patches update Maybe some compile breakage Signed-off-by: Tad <tad@spotco.us>
2023-01-24 18:20:37 -05:00
commentPatches android_kernel_google_dragon.sh "0006-AndroidHardening-Kernel_Hardening/3.18/0026.patch" "0008-Graphene-Kernel_Hardening-ro" "CVE-2015-4167" "CVE-2017-15951" "CVE-2016-1237" "CVE-2016-6198" "CVE-2017-7374" "CVE-2018-17972" "CVE-2019-2214" "CVE-2021-39715/ANY/0001.patch";
Update CVE patchers Untested. I expect some breakage.
2020-08-08 12:03:23 -04:00
commentPatches android_kernel_google_crosshatch.sh "CVE-2020-0067";
Fixup smoke tested: taimen/4.4, fajita/4.9, flame/4.14, bluejay/5.10 Signed-off-by: Tavi <tavi@divested.dev>
2024-10-09 15:05:45 -04:00
commentPatches android_kernel_google_gs101_private_gs-google.sh "CVE-2021-29648/^5.11/0001.patch" "CVE-2023-6817/5.10/0002.patch" "CVE-2023-52462/5.10/0002.patch" "CVE-2023-52672" "CVE-2024-26733/5.10/0002.patch" "CVE-2023-52656/5.10" "CVE-2024-26882" "CVE-2024-38564" "CVE-2022-48862" "CVE-2024-46681" "CVE-2024-46826";
commentPatches android_kernel_google_gs201_private_gs-google.sh "CVE-2021-29648/^5.11/0001.patch" "CVE-2023-6817/5.10/0002.patch" "CVE-2023-52462/5.10/0002.patch" "CVE-2023-52672" "CVE-2024-26733/5.10/0002.patch" "CVE-2023-52656/5.10" "CVE-2024-26882" "CVE-2024-38564" "CVE-2022-48862" "CVE-2024-46681" "CVE-2024-46826";
Revert "Push marlin/sailfish to 20" This reverts commit d021933c6c0c7a9a398887b830e63a204bd066a0.
2024-08-07 20:03:39 -04:00
commentPatches android_kernel_google_marlin.sh "0001-LinuxIncrementals/3.18/3.18.0098-0099.patch" "0006-AndroidHardening-Kernel_Hardening/3.18/0048.patch" "0006-AndroidHardening-Kernel_Hardening/3.18/0049.patch" "0008-Graphene-Kernel_Hardening-canaries/4.4/0002.patch" "CVE-2017-13162/3.18/0001.patch" "CVE-2017-14883" "CVE-2017-15951" "CVE-2018-17972" "CVE-2019-16746" "CVE-2020-0427" "CVE-2020-14381" "CVE-2020-16166" "CVE-2021-39715/ANY/0001.patch" "CVE-2022-42896/4.9";
compile fixups after the CVE-2021-Misc2 import and hardenDefconfig overhaul also sync 18.1 DnsResovler patches with: https://github.com/AICP/packages_modules_DnsResolver/commit/6332b25b8792a40e3800e7b502c0a97156caa7de https://github.com/AICP/packages_modules_DnsResolver/commit/f8490d024a4b21678e12fb7f4425369f1664e163 Signed-off-by: Tad <tad@spotco.us>
2021-10-01 02:18:39 -04:00
commentPatches android_kernel_google_msm.sh "CVE-2017-11015/prima" "CVE-2021-Misc2/ANY/0031.patch";
Fixup Signed-off-by: Tavi <tavi@divested.dev>
2024-10-12 13:03:20 -04:00
commentPatches android_kernel_google_msm-4.9.sh "CVE-2019-19319" "CVE-2020-0067" "CVE-2020-1749" "CVE-2020-8992" "CVE-2021-30324" "CVE-2021-45469" "CVE-2021-30319";
18.1: add sunfish, bramble, and redfin Signed-off-by: Tad <tad@spotco.us>
2021-08-14 02:19:58 -04:00
commentPatches android_kernel_google_redbull.sh "CVE-2018-5873" "CVE-2021-3444" "CVE-2021-3600";
18.1: small fixes Signed-off-by: Tad <tad@spotco.us>
2022-02-12 07:32:29 -05:00
commentPatches android_kernel_google_sunfish.sh "CVE-2021-30324";
GrapheneOS kernel hardening patches update Maybe some compile breakage Signed-off-by: Tad <tad@spotco.us>
2023-01-24 18:20:37 -05:00
commentPatches android_kernel_google_wahoo.sh "0008-Graphene-Kernel_Hardening-canaries/4.4/0002.patch" "CVE-2019-14047/ANY/0002.patch" "CVE-2019-19319" "CVE-2020-1749" "CVE-2020-8992" "CVE-2020-16166" "CVE-2021-30324";
15.1: April ASB work Signed-off-by: Tavi <tavi@divested.dev>
2024-04-08 13:29:17 -04:00
commentPatches android_kernel_google_yellowstone.sh "0001-LinuxIncrementals/3.10/3.10.0098-0099.patch" "CVE-2018-9514" "CVE-2021-47122";
Unbreak last commit This should be most of it also - properly update webview, repopick doesn't seem to handle the branch - always cd back to base, to prevent script breakage
2021-01-24 00:44:34 -05:00
commentPatches android_kernel_huawei_angler.sh "CVE-2014-8559";
Fixup Signed-off-by: Tavi <tavi@divested.dev>
2024-04-08 14:38:51 -04:00
commentPatches android_kernel_htc_flounder.sh "CVE-2018-9514" "CVE-2018-14614/3.4" "CVE-2021-47122";
compile fixups after the CVE-2021-Misc2 import and hardenDefconfig overhaul also sync 18.1 DnsResovler patches with: https://github.com/AICP/packages_modules_DnsResolver/commit/6332b25b8792a40e3800e7b502c0a97156caa7de https://github.com/AICP/packages_modules_DnsResolver/commit/f8490d024a4b21678e12fb7f4425369f1664e163 Signed-off-by: Tad <tad@spotco.us>
2021-10-01 02:18:39 -04:00
commentPatches android_kernel_htc_msm8960.sh "CVE-2018-10876" "CVE-2021-0695" "CVE-2021-Misc2/3.4/0055.patch" "CVE-2021-Misc2/3.4/0056.patch";
m8: Fix display corruption Fixes the screen shifting vertically when in a full screen task like camera Signed-off-by: Tad <tad@spotco.us>
2023-08-31 21:50:24 -04:00
commentPatches android_kernel_htc_msm8974.sh "CVE-2016-8393" "CVE-2022-22058" "CVE-2016-10284/3.18/0001.patch";
More CVE patcher fixes
2020-10-15 16:43:49 -04:00
commentPatches android_kernel_htc_msm8994.sh "CVE-2016-8394/ANY/0001.patch" "CVE-2017-13166" "CVE-2018-3585" "CVE-2018-9514";
Unbreak last commit This should be most of it also - properly update webview, repopick doesn't seem to handle the branch - always cd back to base, to prevent script breakage
2021-01-24 00:44:34 -05:00
commentPatches android_kernel_lge_bullhead.sh "CVE-2014-8559";
Fix errors from compile test of all 14.1 kernels
2020-10-14 09:50:10 -04:00
commentPatches android_kernel_lge_msm8992.sh "CVE-2018-5897" "CVE-2018-11266";
20.0 June ASB work + churn QPR3 is delayed a week now Patches pulled from GrapheneOS and checked against CalyxOS Signed-off-by: Tad <tad@spotco.us>
2023-06-12 20:21:48 -04:00
commentPatches android_kernel_lge_msm8996.sh "0008-Graphene-Kernel_Hardening-canaries/4.4/0002.patch";
Unbreak last commit This should be most of it also - properly update webview, repopick doesn't seem to handle the branch - always cd back to base, to prevent script breakage
2021-01-24 00:44:34 -05:00
commentPatches android_kernel_moto_shamu.sh "CVE-2014-8559";
More fixes Signed-off-by: Tad <tad@spotco.us>
2021-08-03 21:31:34 -04:00
commentPatches android_kernel_motorola_msm8916.sh "0001-LinuxIncrementals/3.10/3.10.0050-0051.patch" "CVE-2014-8559" "CVE-2017-15817" "CVE-2018-9514";
14.1: add athene tried to buy a harpia, ended up with an athene :( Signed-off-by: Tad <tad@spotco.us>
2023-08-29 19:46:57 -04:00
commentPatches android_kernel_motorola_msm8952.sh "0006-AndroidHardening-Kernel_Hardening/3.10/0009.patch" "CVE-2017-9704" "CVE-2017-14880" "CVE-2021-Misc2/3.4/0049.patch";
Updates Signed-off-by: Tad <tad@spotco.us>
2022-12-08 20:33:25 -05:00
commentPatches android_kernel_motorola_msm8974.sh "CVE-2016-5696" "CVE-2017-7373" "CVE-2017-17770/3.4/0002.patch" "CVE-2019-11599" "CVE-2022-22058";
Churn Signed-off-by: Tad <tad@spotco.us>
2023-03-18 06:02:24 -04:00
commentPatches android_kernel_motorola_msm8992.sh "CVE-2017-5551/3.10/0002.patch" "CVE-2017-14880/3.10/0001.patch" "CVE-2017-17770/3.4" "CVE-2018-3585/3.10/0001.patch" "CVE-2019-2297/qcacld-2.0/0001.patch" "0002-Misc_Fixes-uid/3.10/0002-alt1.patch" "CVE-2017-17712/3.10/0010.patch";
Fixup Messy, but better to have CVE-2022-42896 applied to *some* 3.18 kernels Signed-off-by: Tad <tad@spotco.us>
2022-12-17 00:27:09 -05:00
commentPatches android_kernel_motorola_msm8996.sh "0001-LinuxIncrementals/3.18/3.18.0098-0099.patch" "CVE-2017-8266" "CVE-2017-13162/3.18/0001.patch" "CVE-2017-15951" "CVE-2018-17972" "CVE-2019-2214" "CVE-2019-14070/ANY/0006.patch" "CVE-2019-16746" "CVE-2020-0427" "CVE-2020-14381" "CVE-2020-16166" "CVE-2021-39715/ANY/0001.patch" "CVE-2022-42896/4.9";
Fix errors from compile test of all 14.1 kernels
2020-10-14 09:50:10 -04:00
commentPatches android_kernel_nextbit_msm8992.sh "CVE-2018-3585/3.10/0001.patch" "CVE-2018-9514";
Churn Signed-off-by: Tad <tad@spotco.us>
2023-03-18 06:02:24 -04:00
commentPatches android_kernel_oneplus_msm8994.sh "CVE-2018-3585/3.10/0001.patch" "CVE-2018-9514" "0002-Misc_Fixes-uid/3.10/0002-alt1.patch" "CVE-2017-17712/3.10/0010.patch";
Fixup Signed-off-by: Tavi <tavi@divested.dev>
2024-07-17 10:26:36 -04:00
commentPatches android_kernel_oneplus_msm8996.sh "CVE-2017-13162/3.18/0001.patch" "CVE-2017-15951" "CVE-2017-16939" "CVE-2018-17972" "CVE-2019-2214" "CVE-2019-14070/ANY/0006.patch" "CVE-2019-16746" "CVE-2020-0427" "CVE-2020-14381" "CVE-2020-16166" "CVE-2022-42896/4.9" "CVE-2024-39467";
GrapheneOS kernel hardening patches update Maybe some compile breakage Signed-off-by: Tad <tad@spotco.us>
2023-01-24 18:20:37 -05:00
commentPatches android_kernel_oneplus_msm8998.sh "0008-Graphene-Kernel_Hardening-slab" "0008-Graphene-Kernel_Hardening-canaries/4.4/0002.patch" "CVE-2019-11599" "CVE-2019-19319" "CVE-2020-0305" "CVE-2020-8992" "CVE-2020-16166";
20.0: bringup avicii Signed-off-by: Tad <tad@spotco.us>
2023-03-08 16:21:47 -05:00
commentPatches android_kernel_oneplus_sm7250.sh "CVE-2018-5873" "CVE-2020-1749" "CVE-2021-3444" "CVE-2021-3600" "CVE-2021-30324" "CVE-2021-45469" "CVE-2022-42703/4.19/0003.patch";
Update CVE patchers Signed-off-by: Tavi <tavi@divested.dev>
2024-08-25 12:30:55 -04:00
commentPatches android_kernel_oneplus_sm8150.sh "CVE-2019-16746" "CVE-2019-19319" "CVE-2020-0067" "CVE-2020-8992" "CVE-2020-24588/4.14/0018.patch" "CVE-2021-30324" "CVE-2021-45469" "CVE-2022-1184/^5.18/0001.patch" "CVE-2022-42703/4.14/0002.patch" "CVE-2023-52901";
20.0: fixes + r11 churn Signed-off-by: Tad <tad@spotco.us>
2022-10-16 11:06:48 -04:00
commentPatches android_kernel_oneplus_sm8250.sh "CVE-2018-5873" "CVE-2020-1749" "CVE-2021-3444" "CVE-2021-3600" "CVE-2022-1184/^5.18/0001.patch" "CVE-2022-42703/4.19/0003.patch";
Update CVE patchers This expands loose versioning for 4.9 and 4.14 compile tested: - cheeseburger/4.4 - fajita/4.9 - flame/4.14 - FP4/4.19 - lemonadep/5.4 - bluejay/5.10 CVE-2023-52879/5.4 may need to be expanded to other 5.4 kernels this also patches CVE-2024-1086 for 4.9, 4.14, and 5.10 Signed-off-by: Tavi <tavi@divested.dev>
2024-05-31 17:36:02 -04:00
commentPatches android_kernel_oneplus_sm8350.sh "CVE-2018-5873" "CVE-2022-1184/^5.18/0001.patch" "CVE-2023-52879/5.4";
GrapheneOS kernel hardening patches update Maybe some compile breakage Signed-off-by: Tad <tad@spotco.us>
2023-01-24 18:20:37 -05:00
commentPatches android_kernel_razer_msm8998.sh "0008-Graphene-Kernel_Hardening-slab" "0008-Graphene-Kernel_Hardening-canaries/4.4/0002.patch" "CVE-2019-14070/ANY/0005.patch" "CVE-2020-16166";
Small tweaks Signed-off-by: Tad <tad@spotco.us>
2021-12-31 21:14:13 -05:00
commentPatches android_kernel_samsung_apq8084.sh "0006-AndroidHardening-Kernel_Hardening/3.10/0009.patch";
Add missing device variants Signed-off-by: Tad <tad@spotco.us>
2022-04-14 11:42:26 -04:00
commentPatches android_kernel_samsung_d2.sh "CVE-2021-Misc2/3.4/0055.patch" "CVE-2021-Misc2/3.4/0056.patch";
compile fixups after the CVE-2021-Misc2 import and hardenDefconfig overhaul also sync 18.1 DnsResovler patches with: https://github.com/AICP/packages_modules_DnsResolver/commit/6332b25b8792a40e3800e7b502c0a97156caa7de https://github.com/AICP/packages_modules_DnsResolver/commit/f8490d024a4b21678e12fb7f4425369f1664e163 Signed-off-by: Tad <tad@spotco.us>
2021-10-01 02:18:39 -04:00
commentPatches android_kernel_samsung_exynos5420.sh "CVE-2021-Misc2/3.4/0061.patch" "CVE-2021-Misc2/3.4/0062.patch";
Small tweaks
2021-04-12 21:24:57 -04:00
commentPatches android_kernel_samsung_jf.sh "CVE-2019-11599";
Revert 5d57bf13 I don't trust enabling MODULES won't cause weird inane breakage on these legacy devices Signed-off-by: Tad <tad@spotco.us>
2022-05-27 23:46:57 -04:00
commentPatches android_kernel_samsung_manta.sh "CVE-2021-Misc2/3.4/0055.patch" "CVE-2021-Misc2/3.4/0056.patch";
Small tweaks Signed-off-by: Tad <tad@spotco.us>
2021-10-09 19:34:25 -04:00
commentPatches android_kernel_samsung_msm8930-common.sh "CVE-2017-11015/prima" "CVE-2019-11599" "CVE-2021-Misc2/ANY/0031.patch";
Unbreak last commit This should be most of it also - properly update webview, repopick doesn't seem to handle the branch - always cd back to base, to prevent script breakage
2021-01-24 00:44:34 -05:00
commentPatches android_kernel_samsung_smdk4412.sh "CVE-2012-2127" "CVE-2016-8463/ANY/0001.patch";
commentPatches android_kernel_samsung_tuna.sh "CVE-2012-2127";
Fixup TODO: replace with 3.10 patch instead Signed-off-by: Tavi <tavi@divested.dev>
2024-07-16 13:59:27 -04:00
commentPatches android_kernel_samsung_universal8890.sh "0008-Graphene-Kernel_Hardening-ro" "CVE-2016-7917" "CVE-2018-1092" "CVE-2018-17972" "CVE-2019-16746" "CVE-2020-0427" "CVE-2020-14381" "CVE-2020-16166" "CVE-2022-42896/4.9";
Churn + Fixes Fixes https://github.com/Divested-Mobile/DivestOS-Build/issues/338 Signed-off-by: Tavi <tavi@divested.dev>
2024-09-07 22:07:04 -04:00
commentPatches android_kernel_samsung_exynos9810.sh "CVE-2020-1749" "CVE-2019-ctnl-addr-leak" "CVE-2019-18282" "CVE-2019-11599" "CVE-2022-20566" "CVE-2019-16746" "CVE-2021-45469" "CVE-2020-0305" "CVE-2021-3506/4.19" "CVE-2024-26934/4.19" "CVE-2024-26934" "CVE-2024-44944";
Revert 5d57bf13 I don't trust enabling MODULES won't cause weird inane breakage on these legacy devices Signed-off-by: Tad <tad@spotco.us>
2022-05-27 23:46:57 -04:00
commentPatches android_kernel_samsung_universal9810.sh "CVE-2020-1749";
Fixup Signed-off-by: Tavi <tavi@divested.dev>
2024-10-12 13:03:20 -04:00
commentPatches android_kernel_sony_sdm660.sh "0008-Graphene-Kernel_Hardening-canaries/4.4/0002.patch" "CVE-2019-19319" "CVE-2020-0305" "CVE-2020-8992" "CVE-2020-16166" "CVE-2021-30319";
18.1: Device additions h910 lavender pioneer, voyager, discovery akari, aurora, xz2c Signed-off-by: Tad <tad@spotco.us>
2022-01-06 15:29:27 -05:00
commentPatches android_kernel_sony_sdm845.sh "CVE-2019-19319" "CVE-2020-1749" "CVE-2020-8992";
Promotions 16.0 santoni/land to 20.0 Mi8937 unified 17.1 griffin to 18.1 17.1 star*/crownlte to 20.0 20.0 add pro1x Signed-off-by: Tad <tad@spotco.us>
2023-04-17 13:06:09 -04:00
commentPatches android_kernel_xiaomi_msm8937.sh "CVE-2017-13162" "CVE-2019-14070" "CVE-2019-16746" "CVE-2020-0427" "CVE-2020-16166" "CVE-2021-39715/ANY/0001.patch" "CVE-2022-25715";
20.0 June ASB work + churn QPR3 is delayed a week now Patches pulled from GrapheneOS and checked against CalyxOS Signed-off-by: Tad <tad@spotco.us>
2023-06-12 20:21:48 -04:00
commentPatches android_kernel_xiaomi_sdm660.sh "0008-Graphene-Kernel_Hardening-canaries/4.4/0002.patch";
Update CVE patchers Signed-off-by: Tavi <tavi@divested.dev>
2024-08-25 12:30:55 -04:00
commentPatches android_kernel_xiaomi_sm8150.sh "CVE-2020-24588/4.14/0018.patch" "CVE-2023-52901";
Fixup 09494a1c compile tested: vayu, pioneer Signed-off-by: Tad <tad@spotco.us>
2023-11-07 18:59:53 -05:00
commentPatches android_kernel_xiaomi_vayu.sh "CVE-2020-24588/4.14/0018.patch";
Update CVE patchers Signed-off-by: Tavi <tavi@divested.dev>
2024-08-25 12:30:55 -04:00
commentPatches android_kernel_xiaomi_sm6150.sh "CVE-2023-43550" "CVE-2023-52901";
Churn Signed-off-by: Tad <tad@spotco.us>
2023-03-18 06:02:24 -04:00
commentPatches android_kernel_xiaomi_sm8250.sh "CVE-2018-5873" "CVE-2020-1749" "CVE-2021-3444" "CVE-2021-3600" "CVE-2022-22075";
Churn + Fixes Signed-off-by: Tavi <tavi@divested.dev>
2024-06-19 23:57:56 -04:00
commentPatches android_kernel_yandex_sdm660.sh "CVE-2019-11599" "CVE-2019-14070/ANY/0005.patch" "CVE-2019-19319" "CVE-2020-1749" "CVE-2020-8992" "CVE-2020-16166" "CVE-2024-35954";
Unbreak last commit This should be most of it also - properly update webview, repopick doesn't seem to handle the branch - always cd back to base, to prevent script breakage
2021-01-24 00:44:34 -05:00
commentPatches android_kernel_zte_msm8930.sh "CVE-2015-2922" "CVE-2017-11015/prima";
Fixup Messy, but better to have CVE-2022-42896 applied to *some* 3.18 kernels Signed-off-by: Tad <tad@spotco.us>
2022-12-17 00:27:09 -05:00
commentPatches android_kernel_zte_msm8996.sh "0001-LinuxIncrementals/3.18/3.18.0098-0099.patch" "CVE-2017-13162" "CVE-2017-15951" "CVE-2017-16939" "CVE-2018-17972" "CVE-2019-2214" "CVE-2019-14070" "CVE-2019-16746" "CVE-2020-0427" "CVE-2020-14381" "CVE-2020-16166" "CVE-2021-39715/ANY/0001.patch" "CVE-2022-42896/4.9";
Churn Signed-off-by: Tad <tad@spotco.us>
2023-08-24 19:17:46 -04:00
commentPatches android_kernel_zuk_msm8996.sh "0008-Graphene-Kernel_Hardening-slab" "0008-Graphene-Kernel_Hardening-canaries/4.4/0002.patch" "CVE-2019-19319" "CVE-2020-0305" "CVE-2020-1749" "CVE-2020-8992" "CVE-2020-1616";
Initial use of loose versioning for 3.x CVE patches This will for example apply a 3.4 specific patch to 3.0 if no 3.0 specific patch is available. Tested compiling on 14.1 and booting on toroplus. Will be applied to other branches soon. Signed-off-by: Tad <tad@spotco.us>
2021-11-26 13:17:02 -05:00
#Loose versioning hacks
#3.0
declare -a threeDotZero=("android_kernel_samsung_smdk4412.sh" "android_kernel_samsung_tuna.sh");
for script in "${threeDotZero[@]}"
do
commentPatches $script "CVE-2017-15868/3.4" "CVE-2018-10877/3.4";
done
Update CVE patchers This expands loose versioning for 4.9 and 4.14 compile tested: - cheeseburger/4.4 - fajita/4.9 - flame/4.14 - FP4/4.19 - lemonadep/5.4 - bluejay/5.10 CVE-2023-52879/5.4 may need to be expanded to other 5.4 kernels this also patches CVE-2024-1086 for 4.9, 4.14, and 5.10 Signed-off-by: Tavi <tavi@divested.dev>
2024-05-31 17:36:02 -04:00
Initial use of loose versioning for 3.x CVE patches This will for example apply a 3.4 specific patch to 3.0 if no 3.0 specific patch is available. Tested compiling on 14.1 and booting on toroplus. Will be applied to other branches soon. Signed-off-by: Tad <tad@spotco.us>
2021-11-26 13:17:02 -05:00
#3.4
Add missing device variants Signed-off-by: Tad <tad@spotco.us>
2022-04-14 11:42:26 -04:00
declare -a threeDotFour=("${threeDotZero[@]}" "android_kernel_amazon_hdx-common.sh" "android_kernel_asus_grouper.sh" "android_kernel_htc_msm8960.sh" "android_kernel_samsung_exynos5420.sh" "android_kernel_samsung_manta.sh" "android_kernel_google_msm.sh" "android_kernel_lge_hammerhead.sh" "android_kernel_cyanogen_msm8974.sh" "android_kernel_htc_msm8974.sh" "android_kernel_fairphone_msm8974.sh" "android_kernel_lge_g3.sh" "android_kernel_lge_mako.sh" "android_kernel_lge_msm8974.sh" "android_kernel_motorola_msm8974.sh" "android_kernel_oppo_msm8974.sh" "android_kernel_samsung_d2.sh" "android_kernel_samsung_jf.sh" "android_kernel_samsung_msm8930-common.sh" "android_kernel_samsung_msm8974.sh");
Initial use of loose versioning for 3.x CVE patches This will for example apply a 3.4 specific patch to 3.0 if no 3.0 specific patch is available. Tested compiling on 14.1 and booting on toroplus. Will be applied to other branches soon. Signed-off-by: Tad <tad@spotco.us>
2021-11-26 13:17:02 -05:00
for script in "${threeDotFour[@]}"
do
Fixup Signed-off-by: Tavi <tavi@divested.dev>
2024-04-06 19:59:27 -04:00
commentPatches $script "0006-AndroidHardening-Kernel_Hardening/3.10/0008.patch" "0006-AndroidHardening-Kernel_Hardening/3.18/0043.patch" "CVE-2017-5551/3.10" "CVE-2017-7187/3.18" "CVE-2017-18193/3.18" "CVE-2020-14305/4.4" "CVE-2020-24588/4.4/0019.patch" "CVE-2023-1073/4.4" "CVE-2020-29568/4.4" "CVE-2020-27673/4.4" "CVE-2017-2636/4.4" "CVE-2016-4794/4.4" "CVE-2024-26675/4.4/0001.patch";
Initial use of loose versioning for 3.x CVE patches This will for example apply a 3.4 specific patch to 3.0 if no 3.0 specific patch is available. Tested compiling on 14.1 and booting on toroplus. Will be applied to other branches soon. Signed-off-by: Tad <tad@spotco.us>
2021-11-26 13:17:02 -05:00
done
Update CVE patchers This expands loose versioning for 4.9 and 4.14 compile tested: - cheeseburger/4.4 - fajita/4.9 - flame/4.14 - FP4/4.19 - lemonadep/5.4 - bluejay/5.10 CVE-2023-52879/5.4 may need to be expanded to other 5.4 kernels this also patches CVE-2024-1086 for 4.9, 4.14, and 5.10 Signed-off-by: Tavi <tavi@divested.dev>
2024-05-31 17:36:02 -04:00
Initial use of loose versioning for 3.x CVE patches This will for example apply a 3.4 specific patch to 3.0 if no 3.0 specific patch is available. Tested compiling on 14.1 and booting on toroplus. Will be applied to other branches soon. Signed-off-by: Tad <tad@spotco.us>
2021-11-26 13:17:02 -05:00
#3.10
14.1: add athene tried to buy a harpia, ended up with an athene :( Signed-off-by: Tad <tad@spotco.us>
2023-08-29 19:46:57 -04:00
declare -a threeDotTen=("${threeDotFour[@]}" "android_kernel_htc_msm8994.sh" "android_kernel_lge_msm8992.sh" "android_kernel_motorola_msm8992.sh" "android_kernel_asus_fugu.sh" "android_kernel_asus_msm8916.sh" "android_kernel_htc_flounder.sh" "android_kernel_htc_msm8994.sh" "android_kernel_huawei_angler.sh" "android_kernel_lge_bullhead.sh" "android_kernel_moto_shamu.sh" "android_kernel_motorola_msm8952.sh" "android_kernel_nextbit_msm8992.sh" "android_kernel_oneplus_msm8994.sh" "android_kernel_cyanogen_msm8916.sh" "android_kernel_google_yellowstone.sh" "android_kernel_samsung_apq8084.sh" "android_kernel_motorola_msm8916.sh");
Initial use of loose versioning for 3.x CVE patches This will for example apply a 3.4 specific patch to 3.0 if no 3.0 specific patch is available. Tested compiling on 14.1 and booting on toroplus. Will be applied to other branches soon. Signed-off-by: Tad <tad@spotco.us>
2021-11-26 13:17:02 -05:00
for script in "${threeDotTen[@]}"
do
Fixups + Churn Signed-off-by: Tavi <tavi@divested.dev>
2024-08-11 01:07:03 -04:00
commentPatches $script "CVE-2016-1583/3.18" "CVE-2018-17972/3.18" "CVE-2018-20169/3.18" "CVE-2019-2214/3.18" "CVE-2020-0427/3.18" "CVE-2021-21781/3.18" "CVE-2021-46939/3.18" "CVE-2022-40768/4.4" "CVE-2024-26773" "CVE-2024-42154";
Initial use of loose versioning for 3.x CVE patches This will for example apply a 3.4 specific patch to 3.0 if no 3.0 specific patch is available. Tested compiling on 14.1 and booting on toroplus. Will be applied to other branches soon. Signed-off-by: Tad <tad@spotco.us>
2021-11-26 13:17:02 -05:00
done
Update CVE patchers This expands loose versioning for 4.9 and 4.14 compile tested: - cheeseburger/4.4 - fajita/4.9 - flame/4.14 - FP4/4.19 - lemonadep/5.4 - bluejay/5.10 CVE-2023-52879/5.4 may need to be expanded to other 5.4 kernels this also patches CVE-2024-1086 for 4.9, 4.14, and 5.10 Signed-off-by: Tavi <tavi@divested.dev>
2024-05-31 17:36:02 -04:00
Initial use of loose versioning for 3.x CVE patches This will for example apply a 3.4 specific patch to 3.0 if no 3.0 specific patch is available. Tested compiling on 14.1 and booting on toroplus. Will be applied to other branches soon. Signed-off-by: Tad <tad@spotco.us>
2021-11-26 13:17:02 -05:00
#3.18
Revert "Push marlin/sailfish to 20" This reverts commit d021933c6c0c7a9a398887b830e63a204bd066a0.
2024-08-07 20:03:39 -04:00
declare -a threeDotEighteen=("${threeDotTen[@]}" "android_kernel_samsung_universal8890.sh" "android_kernel_google_dragon.sh" "android_kernel_zte_msm8996.sh" "android_kernel_asus_msm8953.sh" "android_kernel_google_marlin.sh" "android_kernel_motorola_msm8996.sh" "android_kernel_oneplus_msm8996.sh");
Initial use of loose versioning for 3.x CVE patches This will for example apply a 3.4 specific patch to 3.0 if no 3.0 specific patch is available. Tested compiling on 14.1 and booting on toroplus. Will be applied to other branches soon. Signed-off-by: Tad <tad@spotco.us>
2021-11-26 13:17:02 -05:00
for script in "${threeDotEighteen[@]}"
do
Fixup Signed-off-by: Tavi <tavi@divested.dev>
2024-10-13 19:58:59 -04:00
commentPatches $script "0008-Graphene-Kernel_Hardening-slub/4.4/0002.patch" "CVE-2016-20022/3.18" "CVE-2018-16597/4.4" "CVE-2019-19319/4.4" "CVE-2020-0305/4.4" "CVE-2020-0429/4.4" "CVE-2020-8992/4.4" "CVE-2021-1048/4.4" "CVE-2021-3428/4.4" "CVE-2021-20265/4.4" "CVE-2021-47277" "CVE-2021-47320" "CVE-2022-1184/4.4/0014.patch" "CVE-2022-1184/4.9/0007.patch" "CVE-2022-40768/4.9/0007.patch" "CVE-2022-40768/4.4/0008.patch" "CVE-2022-47929/4.4" "CVE-2023-0458" "CVE-2023-52435" "CVE-2024-26889" "CVE-2024-35954/^6.9" "CVE-2021-47495/4.4" "CVE-2024-44944" "CVE-2024-42265" "CVE-2023-31083";
Update CVE patchers Likely breakage CVE-2022-48781 maybe change to 5.16-^5.17 Signed-off-by: Tavi <tavi@divested.dev>
2024-07-18 13:36:15 -04:00
#TODO: missing USB_SPEED_SUPER_PLUS
#sed -i 's|CVE-2016-20022/3.18|CVE-2016-20022/3.10|' $script;
Initial use of loose versioning for 3.x CVE patches This will for example apply a 3.4 specific patch to 3.0 if no 3.0 specific patch is available. Tested compiling on 14.1 and booting on toroplus. Will be applied to other branches soon. Signed-off-by: Tad <tad@spotco.us>
2021-11-26 13:17:02 -05:00
done
Update CVE patchers This expands loose versioning for 4.9 and 4.14 compile tested: - cheeseburger/4.4 - fajita/4.9 - flame/4.14 - FP4/4.19 - lemonadep/5.4 - bluejay/5.10 CVE-2023-52879/5.4 may need to be expanded to other 5.4 kernels this also patches CVE-2024-1086 for 4.9, 4.14, and 5.10 Signed-off-by: Tavi <tavi@divested.dev>
2024-05-31 17:36:02 -04:00
Initial loose versioning work for 4.9 This applies 4.9 patches to 4.4 and 3.18 now that 4.4 is EOL Untested, but looks mild Signed-off-by: Tad <tad@spotco.us>
2022-02-22 13:01:58 -05:00
#4.4
Revert "Push marlin/sailfish to 20" This reverts commit d021933c6c0c7a9a398887b830e63a204bd066a0.
2024-08-07 20:03:39 -04:00
declare -a fourDotFour=("${threeDotEighteen[@]}" "android_kernel_essential_msm8998.sh" "android_kernel_fxtec_msm8998.sh" "android_kernel_lge_msm8996.sh" "android_kernel_zuk_msm8996.sh" "android_kernel_xiaomi_sdm660.sh" "android_kernel_sony_sdm660.sh" "android_kernel_razer_msm8998.sh" "android_kernel_oneplus_msm8998.sh" "android_kernel_google_wahoo.sh" "android_kernel_yandex_sdm660.sh" "android_kernel_zuk_msm8996.sh");
Update CVE patchers Signed-off-by: Tad <tad@spotco.us>
2023-05-12 22:01:03 -04:00
for script in "${fourDotFour[@]}"
do
Fixup Signed-off-by: Tavi <tavi@divested.dev>
2024-05-26 22:50:14 -04:00
commentPatches $script "CVE-2021-47006" "CVE-2021-47267" "CVE-2021-47455" "CVE-2023-2513" "CVE-2023-4132";
Update CVE patchers Signed-off-by: Tad <tad@spotco.us>
2023-05-12 22:01:03 -04:00
done
Update CVE patchers This expands loose versioning for 4.9 and 4.14 compile tested: - cheeseburger/4.4 - fajita/4.9 - flame/4.14 - FP4/4.19 - lemonadep/5.4 - bluejay/5.10 CVE-2023-52879/5.4 may need to be expanded to other 5.4 kernels this also patches CVE-2024-1086 for 4.9, 4.14, and 5.10 Signed-off-by: Tavi <tavi@divested.dev>
2024-05-31 17:36:02 -04:00
various small fixes - loose versioning fixes for 4.9 - remove GPG commit verification for GOS repos, they use SSH now. TODO: support that - 20.0: fixup AudioFX stray lines - 20.0: broken fix for gs101/201 stray iwlan lines Signed-off-by: Tad <tad@spotco.us>
2023-01-18 15:54:53 -05:00
#4.9
Promotions 16.0 santoni/land to 20.0 Mi8937 unified 17.1 griffin to 18.1 17.1 star*/crownlte to 20.0 20.0 add pro1x Signed-off-by: Tad <tad@spotco.us>
2023-04-17 13:06:09 -04:00
declare -a fourDotNine=("${fourDotFour[@]}" "android_kernel_fairphone_sdm632.sh" "android_kernel_google_msm-4.9.sh" "android_kernel_oneplus_sdm845.sh" "android_kernel_razer_sdm845.sh" "android_kernel_samsung_exynos9810.sh" "android_kernel_samsung_universal9810.sh" "android_kernel_sony_sdm845.sh" "android_kernel_xiaomi_msm8937.sh" "android_kernel_xiaomi_sdm845.sh");
various small fixes - loose versioning fixes for 4.9 - remove GPG commit verification for GOS repos, they use SSH now. TODO: support that - 20.0: fixup AudioFX stray lines - 20.0: broken fix for gs101/201 stray iwlan lines Signed-off-by: Tad <tad@spotco.us>
2023-01-18 15:54:53 -05:00
for script in "${fourDotNine[@]}"
do
Fixup smoke tested: taimen/4.4, fajita/4.9, flame/4.14, bluejay/5.10 Signed-off-by: Tavi <tavi@divested.dev>
2024-09-19 18:43:01 -04:00
commentPatches $script "CVE-2018-11412/4.14" "CVE-2020-0067/4.14" "CVE-2022-1204/4.14" "CVE-2023-0461/4.14" "CVE-2023-31084" "CVE-2023-4623/^6.5" "CVE-2024-0775/4.14" "CVE-2024-26763" "CVE-2024-42106" "CVE-2023-52901" "CVE-2024-46771";
Update CVE patchers This expands loose versioning for 4.9 and 4.14 compile tested: - cheeseburger/4.4 - fajita/4.9 - flame/4.14 - FP4/4.19 - lemonadep/5.4 - bluejay/5.10 CVE-2023-52879/5.4 may need to be expanded to other 5.4 kernels this also patches CVE-2024-1086 for 4.9, 4.14, and 5.10 Signed-off-by: Tavi <tavi@divested.dev>
2024-05-31 17:36:02 -04:00
done
#4.14
Churn Signed-off-by: Tavi <tavi@divested.dev>
2024-09-08 09:48:56 -04:00
declare -a fourDotFourteen=("${fourDotNine[@]}" "android_kernel_google_msm-4.14.sh" "android_kernel_xiaomi_sm6150.sh" "android_kernel_oneplus_sm8150.sh" "android_kernel_xiaomi_sm8150.sh" "android_kernel_xiaomi_vayu.sh");
Update CVE patchers This expands loose versioning for 4.9 and 4.14 compile tested: - cheeseburger/4.4 - fajita/4.9 - flame/4.14 - FP4/4.19 - lemonadep/5.4 - bluejay/5.10 CVE-2023-52879/5.4 may need to be expanded to other 5.4 kernels this also patches CVE-2024-1086 for 4.9, 4.14, and 5.10 Signed-off-by: Tavi <tavi@divested.dev>
2024-05-31 17:36:02 -04:00
for script in "${fourDotFourteen[@]}"
do
Fixup + Churn run tested: flame, fajita Signed-off-by: Tavi <tavi@divested.dev>
2024-08-17 21:34:17 -04:00
commentPatches $script "CVE-2019-19252/4.19" "CVE-2021-46921/4.19" "CVE-2023-51043/4.19" "CVE-2024-38618" "CVE-2023-52486/^6.7" "CVE-2024-35910";
various small fixes - loose versioning fixes for 4.9 - remove GPG commit verification for GOS repos, they use SSH now. TODO: support that - 20.0: fixup AudioFX stray lines - 20.0: broken fix for gs101/201 stray iwlan lines Signed-off-by: Tad <tad@spotco.us>
2023-01-18 15:54:53 -05:00
done
Initial use of loose versioning for 3.x CVE patches This will for example apply a 3.4 specific patch to 3.0 if no 3.0 specific patch is available. Tested compiling on 14.1 and booting on toroplus. Will be applied to other branches soon. Signed-off-by: Tad <tad@spotco.us>
2021-11-26 13:17:02 -05:00
Hard fail on error Signed-off-by: Tad <tad@spotco.us>
2021-10-16 15:28:15 -04:00
echo -e "\e[0;32m[SCRIPT COMPLETE] Fixed CVE patchers\e[0m";
Reference in New Issue Copy Permalink