group.of.nepali.translators team mailing list archive

[Launchpad Bug Tracker <1775856@xxxxxxxxxxxxxxxxxx>]

This bug was fixed in the package linux - 3.13.0-153.203

---------------
linux (3.13.0-153.203) trusty; urgency=medium

  * linux: 3.13.0-153.203 -proposed tracker (LP: #1776819)

  * CVE-2018-3665 (x86)
    - x86/fpu: Print out whether we are doing lazy/eager FPU context switches
    - x86/fpu: Default eagerfpu=on on all CPUs
    - x86/fpu: Fix math emulation in eager fpu mode

linux (3.13.0-152.202) trusty; urgency=medium

  * linux: 3.13.0-152.202 -proposed tracker (LP: #1776350)

  * CVE-2017-15265
    - ALSA: seq: Fix use-after-free at creating a port

  * register on binfmt_misc may overflow and crash the system (LP: #1775856)
    - fs/binfmt_misc.c: do not allow offset overflow

  * CVE-2018-1130
    - dccp: check sk for closed state in dccp_sendmsg()
    - ipv6: dccp: add missing bind_conflict to dccp_ipv6_mapped

  * add_key04 in LTP syscall test cause kernel oops (NULL pointer dereference)
    with T kernel (LP: #1775316) // CVE-2017-12193
    - assoc_array: Fix a buggy node-splitting case

  * CVE-2017-12154
    - kvm: nVMX: Don't allow L2 to access the hardware CR8

  * CVE-2018-7757
    - scsi: libsas: fix memory leak in sas_smp_get_phy_events()

  * CVE-2018-6927
    - futex: Prevent overflow by strengthen input validation

  * FS-Cache: Assertion failed: FS-Cache: 6 == 5 is false (LP: #1774336)
    - SAUCE: CacheFiles: fix a read_waiter/read_copier race

  * CVE-2018-5803
    - sctp: verify size of a new chunk in _sctp_make_chunk()

  * WARNING: CPU: 28 PID: 34085 at /build/linux-
    90Gc2C/linux-3.13.0/net/core/dev.c:1433 dev_disable_lro+0x87/0x90()
    (LP: #1771480)
    - net/core: generic support for disabling netdev features down stack
    - SAUCE: Backport helper function netdev_upper_get_next_dev_rcu

  * CVE-2018-7755
    - SAUCE: floppy: Do not copy a kernel pointer to user memory in FDGETPRM ioctl

  * CVE-2018-5750
    - ACPI: sbshc: remove raw pointer from printk() message

 -- Stefan Bader <stefan.bader@xxxxxxxxxxxxx>  Thu, 14 Jun 2018 07:00:42
+0200

** Changed in: linux (Ubuntu Bionic)
       Status: Fix Committed => Fix Released

-- 
You received this bug notification because you are a member of नेपाली
भाषा समायोजकहरुको समूह, which is subscribed to Xenial.
Matching subscriptions: Ubuntu 16.04 Bugs
https://bugs.launchpad.net/bugs/1775856

Title:
  register on binfmt_misc may overflow and crash the system

Status in linux package in Ubuntu:
  Incomplete
Status in linux source package in Precise:
  Incomplete
Status in linux source package in Trusty:
  Fix Released
Status in linux source package in Xenial:
  Fix Released
Status in linux source package in Artful:
  Fix Released
Status in linux source package in Bionic:
  Fix Released
Status in linux source package in Cosmic:
  Incomplete

Bug description:
  [Impact]
  When registering a new binfmt_misc handler, it is possible to overflow
  the offset to get a negative value, which might crash the system, or
  possibly leak kernel data.

  Here is a crash log when 2500000000 was used as an offset:

    BUG: unable to handle kernel paging request at ffff989cfd6edca0
    IP: load_misc_binary+0x22b/0x470 [binfmt_misc]
    PGD 1ef3e067 P4D 1ef3e067 PUD 0
    Oops: 0000 [#1] SMP NOPTI
    Modules linked in: binfmt_misc kvm_intel ppdev kvm irqbypass joydev input_leds serio_raw mac_hid parport_pc qemu_fw_cfg parpy
    CPU: 0 PID: 2499 Comm: bash Not tainted 4.15.0-22-generic #24-Ubuntu
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.1-1 04/01/2014
    RIP: 0010:load_misc_binary+0x22b/0x470 [binfmt_misc]
    Call Trace:
      search_binary_handler+0x97/0x1d0
      do_execveat_common.isra.34+0x667/0x810
      SyS_execve+0x31/0x40
      do_syscall_64+0x73/0x130
      entry_SYSCALL_64_after_hwframe+0x3d/0xa2

  Use kstrtoint instead of simple_strtoul.  It will work as the code
  already set the delimiter byte to '\0' and we only do it when the field
  is not empty.

  [Test Case]
  Tested with offsets -1, 2500000000, UINT_MAX and INT_MAX.  Also tested
  with examples documented at Documentation/admin-guide/binfmt-misc.rst
  and other registrations from packages on Ubuntu.

  [Regression]
  Fail to register valid types. This was tested with a bionic kernel with the patch.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1775856/+subscriptions