Approved by:	so

Reviewed by:	kp, markj, bz
Approved by:	so
Security:	FreeBSD-SA-23:06.ipv6
Security:	CVE-2023-3107

(cherry picked from commit ff3d1a3f9d71e706f320f51bae258e4e1a51b388)
(cherry picked from commit 9515f04fe3b12b9e6ef6c802b647dd4cbdba621b)

If a guest tries to reset the fwctl device while a pending request was
in flight, the fwctl state machine can be left in an incomplete state.
Specifically, rinfo is not cleared.

Normally the state machine for fwctl alternates between REQ (receiving
request) and RESP (sending response) and ignores port writes while in
RESP or port reads while in REQ.  Once a guest completes the writes to
the port to send a request, the state machine transitions to RESP and
ignores future writes.

However, if a guest writes a full request and then resets the fwctl
device, the state would transition to REQ without draining the pending
response or discarding the received request.  Instead, additional
port writes after the reset were treated as new payload bytes, but
were appended to the previously-received request and could overflow
the fget_str buffer.

To fix, fully reset the fwctl state machine if the guest requests a
reset.

admbugs:	998
Approved by:	so
Reviewed by:	markj
Reported by:	Omri Ben Bassat <t-benbassato@microsoft.com>
Security:	FreeBSD-SA-23:07.bhyve
Security:	CVE-2023-3494

(cherry picked from commit bed3ae1d7863ac1e0b1e82ae7bf952937e921efe)
(cherry picked from commit 9fe302d78109b12867bd933bb68cd900c9940b7d)

Approved by:	so
Security:	FreeBSD-SA-23:08.ssh
Security:	CVE-2023-38408

Include a portion of the patch that was missed in 813847e49e35.

Reported by:	markj
Fixes:		813847e49e35

(cherry picked from commit bfa51318dee8afd9307f15e49a6a521938dccd06)
(cherry picked from commit d295e418ae7e60d87af6576ecdfad41a98d7442c)

Approved by:	so
Security:	FreeBSD-SA-23:09.pam_krb5
Security:	CVE-2023-3326

Approved by:	so

An adversary on the network can log in via ssh as any user by spoofing
the KDC. When the machine has a keytab installed the keytab is used to
verify the service ticket. However, without a keytab there is no way
for pam_krb5 to verify the KDC's response and get a TGT with the
password.

If both the password _and_ the KDC are controlled by an adversary, the
adversary can provide a password that the adversary's spoofed KDC will
return a valid tgt for.  Currently, without a keytab, pam_krb5 is
vulnerable to this attack.

Reported by:	Taylor R Campbell <riastradh@netbsd.org> via emaste@
Reviewed by:	so
Approved by:	so
Security:	FreeBSD-SA-23:04.pam_krb5
Security:	CVE-2023-3326

(cherry picked from commit 813847e49e35439ba5d7bf16034b0691312068a4)
(cherry picked from commit 6322a6c9daaabbf0b5d17c5d5a4f245f474a7e30)

Before the commit 6cc44223cb6717795afdac4348bbe7e2a968a07d the
field event_mask was fully copied to the EventMasks field.
After this commit the event_mask (uint8_t) is 4 times casted to
EventMask (uint32_t). Because of that 24 bits of each event_mask array
is lost.

This commits brings back simple copying of field, and after words
converting 32 bits field to the requested endian.

I don't think we need more sophisticated method,
as the array is of size 4 (for 32 bits version).

Reviewed by:	imp
MFC after:	1 week
Sponsored by:	Klara Inc.
Differential Revision:	https://reviews.freebsd.org/D39562

(cherry picked from commit ea6597c38c77c7bfaae71259d8636cbb89add6a3)
(cherry picked from commit e7a3a08febd01c95b74185bb971ec29cca64b8e1)

Approved by:	so
Security:	FreeBSD-EN-23:07.mpr

It may be the case that we need to set hw.uart.console manually in some
scenarios that comconsole can't necessarily support.  Avoid clobbering
hw.uart.console unless we've actually selected comconsole so that one
could at least get kernel console output..

Discussed with:	imp
Sponsored by:	Zenith Electronics LLC
Sponsored by:	Klara, Inc.

(cherry picked from commit ec671f4980437008b0119c6367816083e15fa503)
(cherry picked from commit 362677cae8e9ac4c6f7ff4d74a4378ea11d47797)

Approved by:    so
Security:       FreeBSD-EN-23:06.loader

Changes: https://github.com/eggert/tz/blob/2023c/NEWS

The tzdata 2023c release reverts all changes made in 2023b other than
commentary, as that appears to be the best of a bad set of short-notice
choices for modeling this week's daylight saving chaos in Lebanon.

(cherry picked from commit 9fbeeb6e38310b4f42a14c4b043bbee82c5e4752)

Cumulative commit including the following cherry-picks:
9cb5b954606ec8a49b6127d2f58f7ee37ca0bb9c
38e0d28fa4e2f98ebb060441f0aeb0536d6fd202
bb7b15831531a85b1d29e80358e3b80cc799094a

Approved by:	so
Security:	FreeBSD-EN-23:05.tzdata