kernel-packages team mailing list archive

[Mathew Hodson <mathew.hodson@xxxxxxxxx>]

** CVE removed: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2010-4249

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/712609

Title:
  CVE-2010-4248

Status in linux package in Ubuntu:
  Fix Released
Status in linux-fsl-imx51 package in Ubuntu:
  Invalid
Status in linux-ti-omap4 package in Ubuntu:
  Invalid
Status in linux source package in Lucid:
  Fix Released
Status in linux-fsl-imx51 source package in Lucid:
  Fix Released
Status in linux-ti-omap4 source package in Lucid:
  Invalid
Status in linux source package in Maverick:
  Fix Released
Status in linux-fsl-imx51 source package in Maverick:
  Invalid
Status in linux-ti-omap4 source package in Maverick:
  Fix Released
Status in linux source package in Natty:
  Fix Released
Status in linux-fsl-imx51 source package in Natty:
  Invalid
Status in linux-ti-omap4 source package in Natty:
  Invalid
Status in linux source package in Dapper:
  Invalid
Status in linux-fsl-imx51 source package in Dapper:
  Invalid
Status in linux-ti-omap4 source package in Dapper:
  Invalid
Status in linux source package in Hardy:
  Fix Released
Status in linux-fsl-imx51 source package in Hardy:
  Invalid
Status in linux-ti-omap4 source package in Hardy:
  Invalid
Status in linux source package in Karmic:
  Fix Released
Status in linux-fsl-imx51 source package in Karmic:
  Won't Fix
Status in linux-ti-omap4 source package in Karmic:
  Invalid

Bug description:
  posix-cpu-timers.c correctly assumes that the dying process does
  posix_cpu_timers_exit_group() and removes all !CPUCLOCK_PERTHREAD
  timers from signal->cpu_timers list.

  But, it also assumes that timer->it.cpu.task is always the group
  leader, and thus the dead ->task means the dead thread group.

  This is obviously not true after de_thread() changes the leader.
  After that almost every posix_cpu_timer_ method has problems.

  It is not simple to fix this bug correctly. First of all, I think
  that timer->it.cpu should use struct pid instead of task_struct.
  Also, the locking should be reworked completely. In particular,
  tasklist_lock should not be used at all. This all needs a lot of
  nontrivial and hard-to-test changes.

  Change __exit_signal() to do posix_cpu_timers_exit_group() when
  the old leader dies during exec. This is not the fix, just the
  temporary hack to hide the problem for 2.6.37 and stable. IOW,
  this is obviously wrong but this is what we currently have anyway:
  cpu timers do not work after mt exec.

  In theory this change adds another race. The exiting leader can
  detach the timers which were attached to the new leader. However,
  the window between de_thread() and release_task() is small, we
  can pretend that sys_timer_create() was called before de_thread().

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/712609/+subscriptions