kernel-packages team mailing list archive

[Mathew Hodson <mathew.hodson@xxxxxxxxx>]

** Description changed:

- The camera post processing engine (CPP) and video processing engine
- (VPE) provide an ioctl system call interface to user space clients for
- communication. When processing arguments passed to the
- VIDIOC_MSM_CPP_DEQUEUE_STREAM_BUFF_INFO or
- VIDIOC_MSM_VPE_DEQUEUE_STREAM_BUFF_INFO ioctl subdev handlers, a user
- space supplied length value is used to copy memory to a local stack
- buffer without proper bounds checking. An application with access to the
- respective device nodes can use this flaw to, e.g., elevate privileges.
+ Multiple stack-based buffer overflows in the MSM camera driver for the
+ Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android
+ contributions for MSM devices and other products, allow attackers to gain
+ privileges via (1) a crafted VIDIOC_MSM_VPE_DEQUEUE_STREAM_BUFF_INFO ioctl
+ call, related to drivers/media/platform/msm/camera_v2/pproc/vpe/msm_vpe.c,
+ or (2) a crafted VIDIOC_MSM_CPP_DEQUEUE_STREAM_BUFF_INFO ioctl call,
+ related to drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c.
  
  Break-Fix: - c9c81836ee44db9974007d34cf2aaeb1a51a8d45
  Break-Fix: - 28385b9c3054c91dca1aa194ffa750550c50f3ce

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux-armadaxp in Ubuntu.
https://bugs.launchpad.net/bugs/1244800

Title:
  CVE-2013-4738

Status in linux package in Ubuntu:
  Invalid
Status in linux-armadaxp package in Ubuntu:
  Invalid
Status in linux-ec2 package in Ubuntu:
  Invalid
Status in linux-fsl-imx51 package in Ubuntu:
  Invalid
Status in linux-lts-backport-maverick package in Ubuntu:
  Won't Fix
Status in linux-lts-backport-natty package in Ubuntu:
  Won't Fix
Status in linux-lts-quantal package in Ubuntu:
  Invalid
Status in linux-lts-raring package in Ubuntu:
  Invalid
Status in linux-mvl-dove package in Ubuntu:
  Invalid
Status in linux-ti-omap4 package in Ubuntu:
  Invalid
Status in linux source package in Lucid:
  New
Status in linux-armadaxp source package in Lucid:
  Invalid
Status in linux-ec2 source package in Lucid:
  New
Status in linux-fsl-imx51 source package in Lucid:
  Invalid
Status in linux-lts-backport-maverick source package in Lucid:
  Won't Fix
Status in linux-lts-backport-natty source package in Lucid:
  Won't Fix
Status in linux-lts-quantal source package in Lucid:
  Invalid
Status in linux-lts-raring source package in Lucid:
  Invalid
Status in linux-mvl-dove source package in Lucid:
  Invalid
Status in linux-ti-omap4 source package in Lucid:
  Invalid
Status in linux source package in Precise:
  New
Status in linux-armadaxp source package in Precise:
  New
Status in linux-ec2 source package in Precise:
  Invalid
Status in linux-fsl-imx51 source package in Precise:
  Invalid
Status in linux-lts-backport-maverick source package in Precise:
  Won't Fix
Status in linux-lts-backport-natty source package in Precise:
  Won't Fix
Status in linux-lts-quantal source package in Precise:
  Invalid
Status in linux-lts-raring source package in Precise:
  Won't Fix
Status in linux-mvl-dove source package in Precise:
  Invalid
Status in linux-ti-omap4 source package in Precise:
  New
Status in linux source package in Quantal:
  Won't Fix
Status in linux-armadaxp source package in Quantal:
  Won't Fix
Status in linux-ec2 source package in Quantal:
  Invalid
Status in linux-fsl-imx51 source package in Quantal:
  Invalid
Status in linux-lts-backport-maverick source package in Quantal:
  Won't Fix
Status in linux-lts-backport-natty source package in Quantal:
  Won't Fix
Status in linux-lts-quantal source package in Quantal:
  Invalid
Status in linux-lts-raring source package in Quantal:
  Invalid
Status in linux-mvl-dove source package in Quantal:
  Invalid
Status in linux-ti-omap4 source package in Quantal:
  Won't Fix
Status in linux source package in Raring:
  Won't Fix
Status in linux-armadaxp source package in Raring:
  Invalid
Status in linux-ec2 source package in Raring:
  Invalid
Status in linux-fsl-imx51 source package in Raring:
  Invalid
Status in linux-lts-backport-maverick source package in Raring:
  Won't Fix
Status in linux-lts-backport-natty source package in Raring:
  Won't Fix
Status in linux-lts-quantal source package in Raring:
  Invalid
Status in linux-lts-raring source package in Raring:
  Invalid
Status in linux-mvl-dove source package in Raring:
  Invalid
Status in linux-ti-omap4 source package in Raring:
  Won't Fix
Status in linux source package in Saucy:
  Won't Fix
Status in linux-armadaxp source package in Saucy:
  Invalid
Status in linux-ec2 source package in Saucy:
  Invalid
Status in linux-fsl-imx51 source package in Saucy:
  Invalid
Status in linux-lts-backport-maverick source package in Saucy:
  Won't Fix
Status in linux-lts-backport-natty source package in Saucy:
  Won't Fix
Status in linux-lts-quantal source package in Saucy:
  Invalid
Status in linux-lts-raring source package in Saucy:
  Invalid
Status in linux-mvl-dove source package in Saucy:
  Invalid
Status in linux-ti-omap4 source package in Saucy:
  Won't Fix
Status in linux source package in Trusty:
  Invalid
Status in linux-armadaxp source package in Trusty:
  Invalid
Status in linux-ec2 source package in Trusty:
  Invalid
Status in linux-fsl-imx51 source package in Trusty:
  Invalid
Status in linux-lts-backport-maverick source package in Trusty:
  Won't Fix
Status in linux-lts-backport-natty source package in Trusty:
  Won't Fix
Status in linux-lts-quantal source package in Trusty:
  Invalid
Status in linux-lts-raring source package in Trusty:
  Invalid
Status in linux-mvl-dove source package in Trusty:
  Invalid
Status in linux-ti-omap4 source package in Trusty:
  Invalid

Bug description:
  Multiple stack-based buffer overflows in the MSM camera driver for the
  Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android
  contributions for MSM devices and other products, allow attackers to gain
  privileges via (1) a crafted VIDIOC_MSM_VPE_DEQUEUE_STREAM_BUFF_INFO ioctl
  call, related to drivers/media/platform/msm/camera_v2/pproc/vpe/msm_vpe.c,
  or (2) a crafted VIDIOC_MSM_CPP_DEQUEUE_STREAM_BUFF_INFO ioctl call,
  related to drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c.

  Break-Fix: - c9c81836ee44db9974007d34cf2aaeb1a51a8d45
  Break-Fix: - 28385b9c3054c91dca1aa194ffa750550c50f3ce

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1244800/+subscriptions